~/tutorials/024-a-named-script-is-a-question.md

024: A named script is a question with parameters

-sC runs the questions anybody may ask. A named script is one specific question, and --script-args is that question with its parameters filled in. Field work means reading what a script is really asking before you trust the answer, because parameters change the question.

The named question

nmap --script http-title 127.0.0.1

Nmap scan report for localhost (127.0.0.1)
PORT    STATE SERVICE
443/tcp open  ssl/http
| http-title: no findings reported for this host.

One script, one target, one answer. The script asked the HTTP layer what it calls itself and the snapshot had nothing to say, and the footer under that output says where the answer came from. Compare it with what -sC reported for the same question:

nmap -sC 127.0.0.1 | grep http-title

|_http-title: l1ackers.com

Two tools, one question, different answers, and the difference is honest. The default set ran its version of the title question against a live-shaped answer; the named script ran against the snapshot and reported none. Reading both is not redundancy. It is the comparison that tells you which answer carries which provenance, and provenance is what you write down.

The parameters are part of the question

nmap --script http-title --script-args http.useragent=probe 127.0.0.1

Same script, same target, one parameter different, and the answer comes back identical here. On a live host it might not: plenty of services answer differently to a browser's user agent than to a scanner's. The lesson is that --script-args is not decoration on a fixed question. It is part of the question itself, and two runs with different args are two different questions that happen to share a script name.

What a script with no findings means

no findings reported for this host is not "nothing there". It is one question, asked one way, answered from one source. The service on 443 exists, the certificate exists, the title exists, and a reader who equates a quiet script with an absent service has misread the footer. Every refusal and every empty result carries its reason on this site, and the reason is the part worth copying into your notes.

Try it

Each of these has one answer, or a deliberate quiet, and the shell gives it to you. Check yourself.

1. Run the named script and the default set. Which answer names a title and which reports none, and which line in the outputs explains the difference?
2. Run the parameterised version and say what changed in the question. Then say what would have to be true of a live service for the answer to change with it.
3. Ask a script that does not exist, by a name you invent, and read what comes back. Where the findings would go, what arrived instead, and what the footer still says.
4. Ask for vuln and read the refusal as a parameterised question: what would --script vuln be asking, and why does this shell refuse to answer it at any parameter values?

Snapshot answers age with the host, and the footer rides every answer. The command is the current question.