Skip to content
HackIndex.io

Nmap Vulnerability Scanning (NSE)

3 min read Created Dec 29, 2025 Last updated Jan 4, 2026

This page covers host-level vulnerability discovery using Nmap NSE vulnerability scripts.
The goal is to identify known weaknesses in exposed services without exploitation.

This page assumes:

  • hosts are already discovered

  • open ports are known (from Active Reconnaissance)

NSE vuln scripts actively probe services and compare responses against known vulnerability patterns. Output includes script names, CVE references, and a verdict per port. A VULNERABLE result warrants immediate follow-up. A LIKELY VULNERABLE result means the script could not fully confirm the state. Treat it as a lead and verify manually before acting on it.

Vulnerability scan using NSE

Run known vulnerability detection scripts

┌──(kali㉿kali)-[~]
└─$ nmap --script vuln -T3 $TARGET_IP

This runs a curated set of scripts that:

  • check for known CVEs

  • detect common service misconfigurations

  • perform non-exploitative probing

Expect significant scan time on broad targets. The vuln category contains over 100 scripts. Each script runs against every applicable open port. Findings appear under each port listing, indented below the service version line. A clean result does not mean the host is safe. NSE only covers vulnerabilities with written signatures. Unlisted CVEs and logic flaws will not appear in output.

Targeted vulnerability scanning

Limit vulnerability scripts to known open ports

┌──(kali㉿kali)-[~]
└─$ nmap --script vuln -p $OPEN_PORTS -T3 $TARGET_IP

Targeting specific ports cuts scan time and removes irrelevant output. Supply ports from your prior service scan. If a port runs an unexpected service, Nmap version detection fires first and routes the correct scripts to it. Example using a common set of attack-surface ports:

┌──(kali㉿kali)-[~]
└─$ nmap --script vuln -p 22,80,443,445 -T3 $TARGET_IP

Reduces noise and false positives. Running the vuln category against all ports generates output for services with no available signatures. Scoping to known ports keeps results actionable. If you are unsure which ports to include, pull them from your earlier Nmap service scan output.

TLS / SSL vulnerability discovery

Identify weak SSL/TLS configurations

┌──(kali㉿kali)-[~]
└─$ nmap --script ssl-* -p 443,8443 $TARGET_IP

Detects:

  • deprecated protocols

  • weak cipher suites

  • invalid certificates

SSLv2 and SSLv3 are broken. They enable POODLE and DROWN attacks. TLS 1.0 and TLS 1.1 are deprecated and fail PCI-DSS compliance checks. Weak ciphers include NULL, RC4, EXPORT, and anonymous DH variants. Any of these allow an attacker to intercept or decrypt traffic. An expired or self-signed certificate does not enable direct exploitation, but it signals poor maintenance. Confirm ambiguous findings with openssl s_client -connect $TARGET_IP:443 to see the actual negotiated protocol and cipher.

SMB vulnerability discovery

Check SMB services for known vulnerabilities

┌──(kali㉿kali)-[~]
└─$ nmap --script smb-vuln* -p 445 $TARGET_IP

Includes:

  • MS17-010

  • SMB signing issues

MS17-010 (EternalBlue) gives unauthenticated remote code execution on Windows 7 and Server 2008 R2. Unpatched Windows 10 and Server 2012 hosts are also in scope. A VULNERABLE result here is critical and moves directly to exploitation. SMB signing disabled or not required enables NTLM relay attacks. An attacker captures credentials from a poisoned challenge response and replays them against other internal hosts without knowing the plaintext password. Verify MS17-010 results manually before reporting. False positives occur against patched hosts that return atypical TCP responses.

Output handling

Save vulnerability results

┌──(kali㉿kali)-[~]
└─$ nmap --script vuln -oN ${TARGET_NAME}_vulns.txt $TARGET_IP

References