Ravindra BagaleCourses & study guides मराठी Track your progress

20. Vulnerability Scanning and Assessment

20.3 Nmap Vulnerability Scripts

By Last updated:

Nmap cha NSE engine quick vulnerability check sathi pan vaparta yeto. He full scanner nahi, pan pahila andaj milto.

sudo nmap -sV --script vuln 192.168.56.20 -oA 20_nmap_vuln          # all 'vuln' category scripts
sudo nmap -p 21 --script ftp-vsftpd-backdoor 192.168.56.20            # one specific check
sudo nmap -p 445 --script smb-vuln* 192.168.56.20                     # all SMB vulnerability scripts
sudo nmap -sV --script vulners 192.168.56.20                          # match versions to CVEs (needs internet on Kali)

Output shows lines such as State: VULNERABLE with the CVE and references. vulners lists CVEs with CVSS scores for each detected version.

Ravindra Bagale's Tip

If --script vuln does not show "VULNERABLE", that does not mean the system is secure. Nmap scripts check only a small number of known bugs. For the full picture you need a proper scanner like OpenVAS – remember this difference.

Lab

Run sudo nmap -sV --script vuln 192.168.56.20 -oA 20_nmap_vuln. List every finding marked VULNERABLE, with its CVE. Compare this list with your searchsploit table from 20.2.

Using Nmap vuln scripts as a defender

The commands above find possible issues. A defender's job is to turn each finding into a fix on systems they own.

Example 1: your own lab

On Metasploitable 2 (host-only), --script vuln may report the vsftpd backdoor. On a real Amazon Linux server you manage, the same class of check should find nothing, because packages are patched. If it finds something, you:

  1. Confirm the package version with rpm -q or dpkg -l.
  2. Read the vendor advisory.
  3. Patch in a maintenance window.
  4. Re-scan to prove the finding is gone.

Example 2: an Indian company (sample data)

Suppose we are a junior SOC analyst at HDFC Bank's technology partner. A weekly Nmap + vulners scan of the bank's own jump hosts shows an old OpenSSH. The ticket to the Linux team includes the CVE, the CVSS, the host list and the patch command. No exploitation is needed to prioritise the work.

Example 3: everyday life

A smoke alarm does not put out fires. It tells you where to look. Vuln scripts are smoke alarms for network services.

Defensive follow-up by stack

Linux servers (nginx, Apache, SSH, MySQL)

Patch with the OS package manager, then re-scan the host.

sudo dnf update -y openssh && sudo systemctl restart sshd

What you see:

package openssh is updated
Windows servers

Map the CVE to a KB article and deploy with WSUS or Intune.

Containers

Rebuild from a patched base image and redeploy by digest.

trivy image myapp:1.4

What you see:

CRITICAL: 0
Cloud (AWS / Azure / GCP)

Turn on the provider's vulnerability service (Inspector, Defender, Artifact Analysis) for continuous coverage.

Common mistakes

  • Treating "VULNERABLE" from a script as proof without checking the installed package.
  • Scanning networks you do not own.
  • Ignoring findings that have no public exploit. Attackers write new ones.

Recap

  • Scan → confirm → patch → re-scan.
  • Own systems only.

Defender's worksheet (do this today)

  1. Write the lesson title and date in your notebook.
  2. List three systems you own (VMs, personal projects, or lab apps) where this lesson applies.
  3. Run one safe command or checklist item from the lesson on a lab system only.
  4. Paste the command and its output under an Evidence heading.
  5. Write one fix you would give a teammate in two sentences.
  6. Write one mistake students make with this topic and how to avoid it.

More real-world pictures

Indian workplace (sample data)

Suppose we are a junior analyst at Tech Mahindra supporting a client SOC. After reading this lesson you add one detection or one hardening item to the team weekly checklist, with the owner name and a due date. That is how learning becomes operations.

Global practice

Public bodies such as CERT-In (India), CISA (US) and NCSC (UK) publish advisories that map to the same ideas: patch, least privilege, logging and user awareness. Bookmark one advisory feed and read it every Monday.

Home and family

Explain this lesson to a family member in four sentences without jargon. If they can repeat the main warning back to you, you understand it well enough to teach.

Connect to earlier chapters

Parts 1 to 9 built Linux, web servers, databases and cloud pieces. This lesson only makes sense when you can point to a concrete config file, package name or architecture box from those parts. If you cannot, revisit the matching earlier chapter before you practise any tool command.

Common mistakes

  • Skipping written permission just for a quick scan.
  • Practising on hostel or office Wi-Fi targets without authorisation.
  • Collecting tool output without writing the fix.
  • Copying exploit commands onto production to verify. Verification for defenders means checking versions and patches, not firing modules.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.
  • Teach one other person the warning from this lesson.