~/tutorials/013-scripts.md

013: Scripts, and what they are allowed to ask

nmap on its own finds doors. The script engine, NSE, walks through them and asks questions. -sC runs the standard set, the safe questions anybody may ask:

nmap -sC 127.0.0.1

Read the reply for 443:

443/tcp open  ssl/http
| ssl-cert: Subject: commonName=l1ackers.com
|_http-title: l1ackers.com

Two findings, both facts the service volunteered. A certificate says who it claims to be. An HTTP title says what it calls itself. Neither is a vulnerability, and neither claims to be.

One script, by name

nmap --script http-title 127.0.0.1

One question, one answer. The script runs, reports no findings reported for this host, and then the footer: answered from a snapshot, not a live scan, because this shell cannot execute anything. Every scripted answer carries that line, and reading it is the difference between a fact and a story.

What is refused, and why

nmap --script vuln 127.0.0.1
nmap --script exploit 127.0.0.1

Read both refusals, because they argue differently. vuln is refused for honesty: printing vulnerability findings on command would mean inventing them, and a made-up finding on a security site is worse than no feature. exploit is refused for permission: exploitation belongs to a target you hold written authorization for, and this shell holds authorization for exactly one host, its own.

The lesson inside the refusal

The scanner draws a line, says where the line is, and does not cross it. A tool that quietly refuses is annoying. A tool that tells you why it refuses is teaching you its ethics, and this one does it in two different registers: what it will not fake, and what it will not do.

Try it

Each of these has one answer the shell gives you. Check yourself.

1. Run -sC and find the two findings on 443. What does each one claim?
2. Run a named script and read the footer of its answer. Where did the answer come from?
3. Ask for vuln and read the refusal. Whose honesty is it protecting?
4. Ask for exploit and read the refusal. Whose permission is it protecting?

Snapshot answers go stale when the host changes. The footer says what it is every time.