Ravindra BagaleCourses & study guides Track your progress

Guides

Nmap Vulnerability Scan Command (Safe Lab Guide)

By , Cyber Security trainer LinkedIn Published: Last updated:

An Nmap vulnerability scan uses Nmap Scripting Engine (NSE) scripts in the vuln category. On a machine you own, run nmap --script vuln -sV TARGET. Read every finding as a hint, then confirm with versions and patches. Never scan the public internet without written permission.

Quick answer

nmap --script vuln -sV 192.168.56.20
nmap --script "vuln and safe" -sV 192.168.56.20 -oN vuln-lab.txt

Why does this command matter?

Attackers and defenders both ask: "Which known bugs can this host still have?" Nmap can answer that question on a host you are allowed to test. Priya in Pune uses it on her VirtualBox lab before she writes a vulnerability report for class. Marcus in Berlin uses the same idea on a staging server his manager listed in a signed scope email.

What is an Nmap vulnerability scan?

Nmap has a library of scripts (NSE). The vuln category tries to spot known weaknesses from versions, responses and light checks. It is not a full exploit. It is a first pass.

How do I run it step by step?

  1. Write down the exact IP or hostname you are allowed to scan. Example lab: 192.168.56.20.
  2. Update the script database: 
    sudo nmap --script-updatedb

    What it means: Nmap refreshes the NSE script list so vuln checks are not years out of date.

  3. Run a version scan with vuln scripts: 
    nmap --script vuln -sV 192.168.56.20 -p 22,80,443
    PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 8.7
80/tcp  open  http     Apache httpd 2.4.51
|_http-vuln-cve2021-41773: Possible...

    What it means: Port 80 is open on Apache 2.4.51. A script hints at a CVE. Treat it as a lead, not proof.

  4. Prefer safer scripts first when you are unsure: 
    nmap --script "vuln and safe" -sV 192.168.56.20

    What it means: The safe set avoids scripts marked as intrusive. Still lab-only.

  5. On the target, confirm the package (example on Amazon Linux): 
    rpm -q httpd
# or: dpkg -l | grep apache2
    httpd-2.4.51-1.amzn2023

    What it means: The package version matches the banner. Now you can decide if a patch is needed.

  6. Fix (update / config), then scan again and keep both reports.

Common mistakes

  • Scanning a live customer site without a signed scope.
  • Believing every CVE line without checking the real version.
  • Using very aggressive timing (-T5) on a fragile lab router.
  • Forgetting to save output for your ticket or homework.

Ethics and Indian law (short)

In India, unauthorised access and damage to computer systems can fall under the IT Act, 2000. Keep a lab. Keep written permission. When in doubt, stop.

Ravindra Bagale's Tip

Students often treat every red line from --script vuln as a confirmed hole. Many scripts guess from banners. Note the CVE, check the real package version with rpm -q or dpkg -l, then patch. Exploit only in your lab.

Quick quiz: check what you learned

  1. Which flag runs Nmap vulnerability scripts?

    1. --script vuln
    2. --osscan-guess
    3. --traceroute
    4. --min-rate 9999
    Show answer

    A. The vuln category holds NSE scripts that look for known weaknesses.

  2. You may run this scan on:

    1. Your own lab VM only (or written scope)
    2. Any public website you dislike
    3. Your neighbour Wi-Fi without asking
    4. Random AWS IPs you found
    Show answer

    A. Permission and scope come first. Unauthorised scanning can be a crime.

  3. A vuln script reports CVE-2017-0144. Next step?

    1. Confirm the real software version on the host
    2. Run Metasploit on production at once
    3. Ignore it because Nmap is never wrong
    4. Post the IP on social media
    Show answer

    A. Confirm versions and patches. Treat script output as a hint.

  4. How do you save a readable report?

    1. Add -oN vuln-lab.txt
    2. Add --open only
    3. Add -F and delete logs
    4. Add -6 without -sV
    Show answer

    A. -oN writes a normal text report you can attach to a ticket.

Learn it properly

This guide is the short path. These pages go deeper, with labs:

Frequently asked questions

What is the Nmap vulnerability scan command?

On your own lab host run: nmap --script vuln -sV TARGET. Add -p 80,443 if you only want web ports.

Is nmap --script vuln legal?

Yes on systems you own or have written permission to test. Scanning random internet hosts can break the law (IT Act in India).

Why do I get false positives?

Many vuln scripts match banners or guess CVEs. Always confirm the installed package version.

What is the difference between -sV and --script vuln?

-sV finds service versions. --script vuln runs scripts that check for known weaknesses. Use both together.

Where do I learn the deeper lesson?

See Cyber lesson 20.3 Nmap vulnerability scripts and the free Cyber tools hub.