#ZENMAP VULNERABILITY SCRIPT COMMAND WINDOWS#

Type 'help', 'copyright', 'credits' or 'license' for more information. Let's use a few lines of Python to parse the Nmap XML output (that is created via the '-oX' nmap -sV -script=vulners -oX x.x.x.x.xml python3

Once you get some results, our nextВ goal could beВ to automatically process the results. Note that the script accepts one parameter: You can specify the minimum CVSS ('Common Vulnerability Scoring System') scoreВ to nmap -sV -script=vulners -script-args mincvss=8 x.x.x.x In this case, the script requires Internet access to query the Vulners API. The difference between the two scripts is the way they search for CVE. Nmap done: 1 IP address (1 host up) scanned in 100.83 seconds Read data files from: /usr/bin/./share/nmap

#ZENMAP VULNERABILITY SCRIPT COMMAND WINDOWS#

Service Info: OSs: Windows, Windows Server 2008 R2 - 2012 CPE: cpe:/o:microsoft:windows | CVE-2019-10092 4.3 | CVE-2018-11763 4.3 ДЎ39/tcp open netbios-ssn Microsoft Windows netbios-ssnД¤43/tcp open ssl/http Apache httpd 2.4.17 ((Win32) OpenSSL/1.0.2d PHP/5.6.20)Д¤45/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-dsДЈ306/tcp open mysql MariaDB (unauthorized)Д¤9152/tcp open msrpc Microsoft Windows RPCД¤9153/tcp open msrpc Microsoft Windows RPCД¤9154/tcp open msrpc Microsoft Windows RPCД¤9155/tcp open msrpc Microsoft Windows RPCД¤9157/tcp open msrpc Microsoft Windows RPCД¤9158/tcp open msrpc Microsoft Windows RPCД¤9160/tcp open msrpc Microsoft Windows RPC Service scan Timing: About 56.25% done ETC: 17:30 (0:00:44 remaining) Д¬ompleted Service scan at 17:30, 84.04s elapsed (16 services on 1 host)Дў1/tcp open ftp FileZilla ftpd 0.9.41 betaДЁ0/tcp open http Apache httpd 2.4.17 ((Win32) OpenSSL/1.0.2d PHP/5.6.20) at 17:28, 2.17s elapsedДiscovered open port 49158/tcp on x.x.x.xДiscovered open port 49160/tcp on x.x.x.xДiscovered open port 49154/tcp on x.x.x.xДiscovered open port 49152/tcp on x.x.x.xДiscovered open port 49153/tcp on x.x.x.xДiscovered open port 49155/tcp on x.x.x.xДiscovered open port 49157/tcp on x.x.x.xД¬ompleted SYN Stealth Scan at 17:28, 5.58s elapsed (1000 total ports) at 17:28Д¬ompleted Parallel DNS resolution of 1 host. Initiating Parallel DNS resolution of 1 host. nmap -sV -script=vulners -v x.x.x.xД¬ompleted Ping Scan at 17:28, 0.19s elapsed (1 total hosts)

The principle is the same: You scan the host (with '-sV') and, for each identified service, the script performs a lookup in the CVE database. However, a second project was kicked off and integrated into Nmap: The vulners script. Unfortunately, the script was developed by a third-party developer and was never integrated into the official list of scripts. Nmap has a scan type that tries toВ determine the service/version information running behind an open port (enabled withВ the '-sV' flag).В Based on this information, the script looks for interesting CVE in a flat database. The idea was to use Nmap as a lightweight vulnerability scanner. When I read Bojan's diary, it reminded me of an old article that I wrote on my blog a long time ago. The well-known port scanner can be extended with plenty of scripts that are launched depending on the detected ports. Yesterday, Bojan wrote a nice diary about the power of the Nmap scripting language (based on LUA).

Zenmap vulnerability script command