Nmap Intermediate: NSE Scripting, Evasion and Pentest Workflows

This is Part 2 of the Nmap series. If you’re not yet comfortable with scan types, host discovery, timing, and output formats, start with Part 1: Nmap for Beginners first.

This guide picks up where the basics leave off – covering the Nmap Scripting Engine in depth, techniques for staying under the radar on real engagements, and the five-phase recon workflow that professional pentesters actually use. All examples use Metasploitable2 on a private host-only network.

The Nmap Scripting Engine (NSE)

NSE is where Nmap transforms from a port scanner into something much more powerful. Scripts are written in Lua and organised into categories. They can detect vulnerabilities, enumerate services, brute-force credentials, and a lot more – all without switching tools.

Script Categories

• auth: Authentication testing – default credentials, bypass techniques
• brute: Credential brute-forcing against services
• default: Scripts run automatically with -sC or -A – safe and informational
• discovery: Service and network enumeration
• exploit: Actual exploitation – use carefully and only with authorisation
• intrusive: Scripts that may crash or adversely affect targets
• safe: Unlikely to cause any harm – good for passive enumeration
• vuln: Vulnerability checks – the category you’ll use most

Running NSE Scripts

# Run default scripts (safe, informational - equivalent to -sC)
sudo nmap --script default 192.168.56.101

# Run all vulnerability checks
sudo nmap --script vuln 192.168.56.101

# Run a specific script
sudo nmap --script ftp-anon 192.168.56.101

# Run multiple scripts
sudo nmap --script http-title,http-headers,http-methods 192.168.56.101 -p 80,443

# Run scripts with arguments
sudo nmap --script http-brute --script-args userdb=/usr/share/wordlists/users.txt,passdb=/usr/share/wordlists/rockyou.txt 192.168.56.101

SMB Enumeration

SMB is one of the richest attack surfaces on internal networks. These scripts give you share listings, user enumeration, and vulnerability checks in one pass.

sudo nmap --script smb-enum-shares,smb-enum-users -p 445 192.168.56.101
sudo nmap --script smb-vuln-ms17-010 -p 445 192.168.56.101  # EternalBlue check
sudo nmap --script smb-security-mode -p 445 192.168.56.101

HTTP Enumeration

sudo nmap --script http-enum,http-methods,http-headers -p 80,443 192.168.56.101
sudo nmap --script http-shellshock -p 80 192.168.56.101
sudo nmap --script http-title 192.168.56.101

FTP

sudo nmap --script ftp-anon,ftp-bounce,ftp-brute -p 21 192.168.56.101

Against Metasploitable2, ftp-anon will confirm anonymous login is allowed – a finding in its own right, and a foothold for further enumeration.

SSH

sudo nmap --script ssh-auth-methods,ssh-hostkey -p 22 192.168.56.101

DNS

sudo nmap --script dns-zone-transfer -p 53 192.168.56.101
sudo nmap --script dns-brute 192.168.56.101

Full Vulnerability Scan

sudo nmap --script vuln 192.168.56.101

This runs every script in the vuln category – useful for a broad sweep but can be noisy and slow. Better practice on real engagements is to run targeted scripts based on what you found in your port and version scan.

Evasion Techniques

IDS/IPS systems, firewalls, and WAFs will try to detect and block your scans. These techniques won’t make you invisible – modern security tooling catches most of them – but they’re worth understanding both for engagements where evasion is in scope and for your OSCP preparation.

Packet Fragmentation (-f)

Splits packets into 8-byte fragments. Can confuse older or simpler packet inspection systems that don’t reassemble fragments before inspecting them.

sudo nmap -f 192.168.56.101

Decoy Scanning (-D)

Sends scan traffic from multiple spoofed IP addresses alongside your real one. The target sees traffic from all the decoys, making it harder to identify which source is the real attacker.

sudo nmap -D 10.0.0.1,10.0.0.2,10.0.0.3 192.168.56.101
sudo nmap -D RND:10 192.168.56.101  # 10 random decoys

Source Port Manipulation (–source-port)

Some firewalls trust traffic originating from certain ports (like 53 or 80). Spoofing a trusted source port can bypass these rules on misconfigured devices.

sudo nmap --source-port 53 192.168.56.101

Randomise Hosts (–randomize-hosts)

When scanning a subnet, randomising the scan order avoids the sequential sweep pattern that rate-based IDS signatures look for.

sudo nmap --randomize-hosts 192.168.56.0/24

MAC Address Spoofing (–spoof-mac)

sudo nmap --spoof-mac 0       # Random MAC address
sudo nmap --spoof-mac Apple   # Random MAC within Apple's OUI range

Slow Timing for IDS Evasion

sudo nmap -T1 --scan-delay 5s 192.168.56.101

Slowing your scan below the threshold that IDS rate-based rules trigger on. Painful for large networks but sometimes necessary on external engagements where stealth is a requirement.

Five-Phase Pentest Workflow

This is the structured approach that professional pentesters use on real engagements. Each phase feeds into the next.

Phase 1: Host Discovery

sudo nmap -sn -T4 192.168.1.0/24 -oG hosts_alive.gnmap
grep "Up" hosts_alive.gnmap | cut -d " " -f 2 > live_hosts.txt

Phase 2: Quick Port Scan

sudo nmap -sS -T4 --top-ports 1000 -iL live_hosts.txt -oA quick_scan

Phase 3: Full Port Scan on Interesting Hosts

sudo nmap -sS -p- -T4 192.168.1.100 -oA full_scan

Phase 4: Service and Vulnerability Enumeration

sudo nmap -sV -sC -O --script vuln -p 22,80,443,445 192.168.1.100 -oA detailed_scan

Phase 5: Targeted NSE Scripts

Based on what Phase 4 reveals, run service-specific scripts. SMB open? Run smb-enum-shares and check for EternalBlue. Web server? Run http-enum and http-methods. MySQL? Run mysql-empty-password and mysql-databases. FTP? Check for anonymous login. The version numbers from -sV tell you exactly which scripts are worth running.

Importing Results into Metasploit

Nmap’s XML output integrates directly with Metasploit’s database, populating its host and service tables so you don’t have to re-enter target information manually.

# In msfconsole
msf6 > db_import /path/to/detailed_scan.xml
msf6 > hosts
msf6 > services
msf6 > hosts -R  # Set RHOSTS to all discovered hosts

This is the bridge between reconnaissance and exploitation. The version numbers Nmap discovers map directly to Metasploit module names – vsftpd 2.3.4 becomes exploit/unix/ftp/vsftpd_234_backdoor, Samba 3.0.20 becomes exploit/multi/samba/usermap_script.

Summary

The five-phase workflow is the key thing to internalise: host discovery, quick port scan, full port scan on interesting targets, service and vulnerability enumeration, then targeted NSE scripts based on what you find. Save everything with -oA and import into Metasploit for your exploitation phase.

For the exploitation side of this workflow, the Metasploit series picks up where this leaves off – starting with Metasploit for Beginners: Your First Shell.