NMap NSE Tutorial

#####################################################
# 2020 Intro to NMAP NSE           					#
# By Joe McCray                                     #
#####################################################

- Here is a good set of slides for getting started with Linux:
http://www.slideshare.net/olafusimichael/linux-training-24086319


- Here is a good tutorial that you should complete before doing the labs below:
http://linuxsurvival.com/linux-tutorial-introduction/


- I prefer to use Putty to SSH into my Linux host.
- You can download Putty from here:
- http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe

Here is the information to put into putty

Host Name:          149.28.201.171
protocol:           ssh
port:               22
username:           cysa
password:           cysa!cysa123!


If you are on a Mac (https://osxdaily.com/2017/04/28/howto-ssh-client-mac/)

Open a terminal, then type:
-------------------------------
ssh -l cysa 149.28.201.171
------------------------------



#########################
# Playing with Nmap NSE #
#########################

nmap -Pn -p80 --script ip-geolocation-* infosecaddicts.com

nmap -p80 --script dns-brute infosecaddicts.com

nmap --script http-robtex-reverse-ip secore.info

nmap -Pn -p80 --script=http-headers infosecaddicts.com


ls /usr/share/nmap/scripts | grep http
nmap -Pn -p80 --script=http-* infosecaddicts.com




#####################################
# Writing Your Own Nmap NSE Scripts #
#####################################


-----------------------Type this command -----------------------------
sudo nano /usr/share/nmap/scripts/intro-nse.nse
----------------------------------------------------------------------



-------------Paste the following into the file-----------------------
-- The Head Section --
-- The Rule Section --
portrule = function(host, port)
    return port.protocol == "tcp"
            and port.number == 80
            and port.state == "open"
end

-- The Action Section --
action = function(host, port)
    return "Advanced CyberWar!"
end
----------------------------------------------------------------------

- Ok, now that we've made that change let's run the script
-----------------------Type this command -----------------------------
sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse infosecaddicts.com -p 22,80,443
 ----------------------------------------------------------------------





-----------------------Type this command -----------------------------
sudo nano /usr/share/nmap/scripts/intro-nse.nse
----------------------------------------------------------------------



-------------Paste the following into the file-----------------------
-- The Head Section --
local shortport = require "shortport"

-- The Rule Section --
portrule = shortport.http


-- The Action Section --
action = function(host, port)
    return "Advanced CyberWar!"
end
----------------------------------------------------------------------

- Ok, now that we've made that change let's run the script
sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse www.darkoperator.com -p 22,80,443
----------------------------------------------------------------------






OK, now let's have some fun with my buddy Carlos Perez's website.

-----------------------Type this command -----------------------------
sudo nano /usr/share/nmap/scripts/intro-nse.nse
----------------------------------------------------------------------



-------------Paste the following into the file-----------------------
-- The Head Section --
local shortport = require "shortport"
local http = require "http"

-- The Rule Section --
portrule = shortport.http

-- The Action Section --
action = function(host, port)

    local uri = "/installing-metasploit-in-ubunt/"
    local response = http.get(host, port, uri)
    return response.status

end
----------------------------------------------------------------------

- Ok, now that we've made that change let's run the script
sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse www.darkoperator.com -p 22,80,443
----------------------------------------------------------------------



-----------------------Type this command -----------------------------
sudo nano /usr/share/nmap/scripts/intro-nse.nse
----------------------------------------------------------------------



-------------Paste the following into the file-----------------------
-- The Head Section --
local shortport = require "shortport"
local http = require "http"

-- The Rule Section --
portrule = shortport.http

-- The Action Section --
action = function(host, port)

    local uri = "/installing-metasploit-in-ubunt/"
    local response = http.get(host, port, uri)

    if ( response.status == 200 ) then
        return response.body
    end

end
----------------------------------------------------------------------

- Ok, now that we've made that change let's run the script
sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse www.darkoperator.com -p 22,80,443
----------------------------------------------------------------------








-----------------------Type this command -----------------------------
sudo nano /usr/share/nmap/scripts/intro-nse.nse
----------------------------------------------------------------------



-------------Paste the following into the file-----------------------
-- The Head Section --
local shortport = require "shortport"
local http = require "http"
local string = require "string"

-- The Rule Section --
portrule = shortport.http

-- The Action Section --
action = function(host, port)

    local uri = "/installing-metasploit-in-ubunt/"
    local response = http.get(host, port, uri)

    if ( response.status == 200 ) then
        local title = string.match(response.body, "Installing Metasploit in Ubuntu and Debian")
        return title
    end

end
----------------------------------------------------------------------

- Ok, now that we've made that change let's run the script
sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse www.darkoperator.com -p 22,80,443
----------------------------------------------------------------------






-----------------------Type this command -----------------------------
sudo sudo nano /usr/share/nmap/scripts/intro-nse.nse
----------------------------------------------------------------------



-------------Paste the following into the file-----------------------
-- The Head Section --
local shortport = require "shortport"
local http = require "http"
local string = require "string"

-- The Rule Section --
portrule = shortport.http

-- The Action Section --
action = function(host, port)

    local uri = "/installing-metasploit-in-ubunt/"
    local response = http.get(host, port, uri)

    if ( response.status == 200 ) then
        local title = string.match(response.body, "Installing Metasploit in Ubuntu and Debian")

        if (title) then
            return "Vulnerable"
        else
            return "Not Vulnerable"
        end
    end
end

----------------------------------------------------------------------




- Ok, now that we've made that change let's run the script
-----------------------Type this command -----------------------------
sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse www.darkoperator.com -p 22,80,443
----------------------------------------------------------------------