# Nmap Vulnerability Scanning (NSE)

- **URL:** https://hackindex.io/services/hosts/vulnerability-discovery/nmap-vulnerability-scanning
- **Path:** Hosts > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/hosts/vulnerability-discovery.md)
- **Published:** 2025-12-29
- **Updated:** 2026-01-04

This page covers **host-level vulnerability discovery** using **Nmap NSE vulnerability scripts**.  
The goal is to **identify known weaknesses** in exposed services **without exploitation**.

This page assumes:

- hosts are already discovered
- open ports are known (from Active Reconnaissance)

NSE vuln scripts actively probe services and compare responses against known vulnerability patterns. Output includes script names, CVE references, and a verdict per port. A **VULNERABLE** result warrants immediate follow-up. A **LIKELY VULNERABLE** result means the script could not fully confirm the state. Treat it as a lead and verify manually before acting on it.

## Vulnerability scan using NSE

**Run known vulnerability detection scripts**

```bash
nmap --script vuln -T3 $TARGET_IP
```

This runs a curated set of scripts that:

- check for known CVEs
- detect common service misconfigurations
- perform non-exploitative probing

Expect significant scan time on broad targets. The vuln category contains over 100 scripts. Each script runs against every applicable open port. Findings appear under each port listing, indented below the service version line. A clean result does not mean the host is safe. NSE only covers vulnerabilities with written signatures. Unlisted CVEs and logic flaws will not appear in output.

## Targeted vulnerability scanning

**Limit vulnerability scripts to known open ports**

```bash
nmap --script vuln -p $OPEN_PORTS -T3 $TARGET_IP
```

Targeting specific ports cuts scan time and removes irrelevant output. Supply ports from your prior service scan. If a port runs an unexpected service, Nmap version detection fires first and routes the correct scripts to it. Example using a common set of attack-surface ports:

```bash
nmap --script vuln -p 22,80,443,445 -T3 $TARGET_IP
```

Reduces noise and false positives. Running the vuln category against all ports generates output for services with no available signatures. Scoping to known ports keeps results actionable. If you are unsure which ports to include, pull them from your earlier Nmap service scan output.

## TLS / SSL vulnerability discovery

**Identify weak SSL/TLS configurations**

```bash
nmap --script ssl-* -p 443,8443 $TARGET_IP
```

Detects:

- deprecated protocols
- weak cipher suites
- invalid certificates

SSLv2 and SSLv3 are broken. They enable POODLE and DROWN attacks. TLS 1.0 and TLS 1.1 are deprecated and fail PCI-DSS compliance checks. Weak ciphers include NULL, RC4, EXPORT, and anonymous DH variants. Any of these allow an attacker to intercept or decrypt traffic. An expired or self-signed certificate does not enable direct exploitation, but it signals poor maintenance. Confirm ambiguous findings with `openssl s_client -connect $TARGET_IP:443` to see the actual negotiated protocol and cipher.

## SMB vulnerability discovery

**Check SMB services for known vulnerabilities**

```bash
nmap --script smb-vuln* -p 445 $TARGET_IP
```

Includes:

- MS17-010
- SMB signing issues

MS17-010 (EternalBlue) gives unauthenticated remote code execution on Windows 7 and Server 2008 R2. Unpatched Windows 10 and Server 2012 hosts are also in scope. A VULNERABLE result here is critical and moves directly to exploitation. SMB signing disabled or not required enables NTLM relay attacks. An attacker captures credentials from a poisoned challenge response and replays them against other internal hosts without knowing the plaintext password. Verify MS17-010 results manually before reporting. False positives occur against patched hosts that return atypical TCP responses.

## Output handling

**Save vulnerability results**

```bash
nmap --script vuln -oN ${TARGET_NAME}_vulns.txt $TARGET_IP
```

## References

- [NMAP all SMB Vulnerability scripts](https://nmap.org/search/?q=smb-vuln%20NSE%20script) - Shows a list of all SMB vulnerabilities NSE scripts
- [NMAP all SSL scripts](https://nmap.org/search/?q=ssl%20NSE%20script) - Shows a list of all SSL NSE scripts
- [NMAP vulnerability scripts](https://nmap.org/nsedoc/categories/vuln.html) - All NMAP vulnerability NSE scripts