Nmap NSE Scripts (2026)

[!important]+ Purpose This is the compact, action-first NSE sheet: how to select, review, run, constrain, and troubleshoot scripts during an authorized assessment. For detailed per-port write-ups and example output, use NSE Guide. Pair with Nmap Cheatsheet 2026 and Common Ports and Services Cheatsheet 2026.

[!danger]+ NSE Executes Code NSE scripts are Lua programs and are not sandboxed. Category labels describe intent; they are not a guarantee of safety. Audit third-party scripts and review --script-help before using intrusive, brute, vuln, exploit, dos, or fuzzer against anything sensitive.

The 60-Second Workflow

# 1. Find the service and version first
nmap -Pn -n -sV -p443 <target>

# 2. Inspect candidate scripts before executing them
nmap --script-help 'http-title,ssl-cert,ssl-enum-ciphers'

# 3. Run an explicit, reviewable bundle and save evidence
nmap -Pn -n -sV -p443 \
  --script=http-title,http-headers,ssl-cert,ssl-enum-ciphers \
  <target> -oA nse-https

# 4. Trace only when output is missing or surprising
nmap -Pn -n -p443 --script=ssl-cert --script-trace <target>

[!tip]+ Explicit Names Beat Giant Categories --script=vuln is easy to type but difficult to review and reproduce. A comma-separated list records exactly what was approved and run. Use categories for discovery, then narrow the final evidence command to named scripts.

Selection Syntax

[!warning]+ The + Prefix Bypasses a Safety Check A script’s portrule/hostrule normally decides whether it applies. Forcing execution is useful on non-standard ports, but first add -sV and verify the detected service. Do not use + merely because a script produced no output.

Script Categories by Operational Risk

# Review everything selected by an expression without touching a target
nmap --script-help '(default or safe) and not external'

# Controlled low-impact starting point
nmap -sV --script='default or safe' <target>

Script Arguments

# Inline comma-separated key/value pairs: quote the whole expression
nmap -p80 --script=http-title \
  --script-args='http.host=app.example.test' <target>

# SMB authentication
nmap -p445 --script=smb-enum-shares \
  --script-args='smbdomain=ACME,smbusername=alice,smbpassword=Password123!' \
  <target>

# SNMP community supplied as an empty username plus password/community
sudo nmap -sU -p161 --script=snmp-info,snmp-sysdescr \
  --script-args='creds.snmp=:public' <target>

# Prefer a file when values need complex quoting or should not sit in history
nmap -p445 --script=smb-enum-shares \
  --script-args-file nse-args.txt <target>

[!warning]+ Credential Handling Command-line secrets may appear in shell history and process listings. Use dedicated assessment credentials, protect argument files, remove them according to the evidence-handling plan, and prefer Kerberos/ticket workflows where the script supports them.

Useful Global Controls

Protocol Bundles — Review Before Use

[!note]+ Adjust Ports to the Detected Service The ports below are defaults, not requirements. Run -sV, then target the actual service wherever it is listening. Most examples favor safe/discovery scripts, but specifically marked follow-ups include auth or intrusive scripts.

FTP — TCP 21

nmap -sV -p21 --script=ftp-anon,ftp-syst,ftp-bounce <target>

SSH — TCP 22

nmap -sV -p22 \
  --script=ssh-hostkey,ssh2-enum-algos <target>

# Categorized auth/intrusive: run only after reviewing impact
nmap --script-help ssh-auth-methods
nmap -sV -p22 --script=ssh-auth-methods <target>

SMTP — TCP 25/465/587

nmap -sV -p25,465,587 \
  --script=smtp-commands,smtp-ntlm-info <target>

# Open-relay testing can cause delivery attempts: review script/RoE first
nmap --script-help smtp-open-relay

DNS — TCP/UDP 53

sudo nmap -sS -sU -p T:53,U:53 \
  --script=dns-nsid,dns-recursion <target>

# Zone transfer is an explicit follow-up against an authoritative server
nmap -p53 --script=dns-zone-transfer \
  --script-args='dns-zone-transfer.domain=example.test' <dns-server>

HTTP — TCP 80/443/8000/8080/8443

nmap -sV -p80,443,8000,8080,8443 \
  --script=http-title,http-headers,http-methods <target>

# More requests and path guessing: useful, but noisier
nmap -sV -p80,443 --script=http-enum <target>

TLS — Any TLS-Wrapped Port

# ssl-enum-ciphers makes many TLS connections and is categorized intrusive
nmap -sV -p443,465,636,993,995,8443 \
  --script=ssl-cert,ssl-enum-ciphers,ssl-dh-params <target>

SMB — TCP 445/139

nmap -sV -p139,445 \
  --script=smb-protocols,smb2-capabilities,smb2-security-mode,smb2-time,smb-os-discovery \
  <target>

# Share/user enumeration may require credentials and generates audit events
nmap -p445 --script=smb-enum-shares,smb-enum-users <target>

LDAP / Active Directory — TCP 389/636/3268/3269

nmap -sV -p389,636,3268,3269 \
  --script=ldap-rootdse,ssl-cert <domain-controller>

# ldap-search can return substantial directory data; inspect arguments first
nmap --script-help ldap-search

SNMP — UDP 161

sudo nmap -sU -sV -p161 \
  --script=snmp-info,snmp-sysdescr,snmp-interfaces \
  --script-args='creds.snmp=:public' <target>

RPC / NFS — TCP/UDP 111 and TCP/UDP 2049

sudo nmap -sS -sU -sV -p T:111,2049,U:111,2049 \
  --script=rpcinfo,nfs-showmount,nfs-ls,nfs-statfs <target>

Databases and Data Stores

# MySQL
nmap -sV -p3306 --script=mysql-info <target>

# Categorized auth/intrusive: explicit empty-password check
nmap --script-help mysql-empty-password
nmap -sV -p3306 --script=mysql-empty-password <target>

# Microsoft SQL Server
nmap -sV -p1433 --script=ms-sql-info,ms-sql-ntlm-info <target>

# MongoDB
nmap -sV -p27017 --script=mongodb-info,mongodb-databases <target>

# Redis
nmap -sV -p6379 --script=redis-info <target>

Remote Desktop and VNC

nmap -sV -p3389 --script=rdp-enum-encryption,rdp-ntlm-info <target>
nmap -sV -p5900-5905 --script=vnc-info <target>

Docker API

nmap -sV -p2375,2376 --script=docker-version,ssl-cert <target>

Broadcast and Prerule Discovery

# Local-segment discovery; many broadcast scripts do not need a target
sudo nmap --script=broadcast-dhcp-discover
sudo nmap --script=broadcast-dns-service-discovery
sudo nmap --script=broadcast-upnp-info

# Allow a script to add discovered addresses to Nmap's scan queue
sudo nmap --script=broadcast-dns-service-discovery \
  --script-args=newtargets

[!warning]+ newtargets Can Expand Scope Broadcast/multicast replies may reveal systems not present in the original target list. Do not enable newtargets unless the resulting local segment is explicitly authorized.

Why a Script Did Not Run or Returned Nothing

# Minimal debugging pattern
nmap -Pn -n -sV -p443 \
  --script=ssl-cert --script-timeout 30s -d2 <target>

# Packet-level script view; keep the port/script set tiny
nmap -Pn -n -p443 --script=ssl-cert --script-trace <target>

Local Script Discovery and Maintenance

# Installed scripts on this Arch/Omarchy system
find /usr/share/nmap/scripts -maxdepth 1 -type f -name '*.nse' | sort

# Search by protocol or technique
rg -l 'categories.*vuln' /usr/share/nmap/scripts
rg -l 'SMB|smb' /usr/share/nmap/scripts

# Rebuild the index after adding or removing a trusted script
sudo nmap --script-updatedb

[!danger]+ Third-Party Script Review Checklist

1. Read the complete .nse file and every non-standard library it loads.
2. Check categories, prerule/hostrule/portrule, and the action function.
3. Look for file writes, os.execute, external network calls, credential handling, and exploit/DoS behaviour.
4. Pin the source/commit in engagement notes; do not silently replace evidence tooling mid-assessment.
5. Test against a lab clone before production-like systems.

Quick Reference Card

nmap -sV -sC <target>                         # curated defaults
nmap --script-help '<expression>'             # review without scanning
nmap -sV --script='default or safe' <target>  # broader low-impact pass
nmap --script='<name1>,<name2>' <target>      # explicit bundle
nmap --script='http-*' -p80,443 <target>      # quoted wildcard
nmap --script-args='key=value' <target>       # inline argument
nmap --script-args-file args.txt <target>     # argument file
nmap --script-timeout 30s --script=...        # per-script ceiling
nmap --script-trace --script=...              # script traffic debug
sudo nmap --script-updatedb                    # rebuild local script index

References

1. Nmap NSE Usage and Examples
2. Nmap Scripting Engine Reference
3. NSE Documentation Portal
4. NSE Script Format
5. NSE Guide — comprehensive vault reference