How to run a scan equivalent to nmap vulnerabilities scan

Question

I use Nmap for network reconnaissance but want to run a vulnerability scan equivalent to what tools like Nessus or OpenVAS provide. My questions are:

• Which Nmap scripts (NSE) are useful for vulnerability scanning?
• How to automate and filter relevant security findings.
• How to compare Nmap’s capabilities to dedicated vulnerability scanners.
  A detailed command-line example would be great.

Answer 1

Nmap is a versatile network scanning tool that, when extended with its Scripting Engine (NSE), can perform vulnerability assessments akin to those offered by dedicated scanners like Nessus or OpenVAS. Here's how you can utilize Nmap for comprehensive vulnerability scanning:

1. Utilizing Nmap Scripts (NSE) for Vulnerability Scanning

Nmap's Scripting Engine includes a variety of scripts specifically designed for vulnerability detection. These scripts can be employed to identify potential security issues across your network.

• Vulnerability Detection Scripts: Nmap categorizes its scripts, and those under the vuln category are tailored for identifying vulnerabilities. To execute these scripts:

nmap -sV --script vuln <target>

This command initiates a service version detection scan (-sV) and runs all scripts in the vuln category against the specified target.

• Vulners Script: For an extensive vulnerability assessment, the vulners script integrates Nmap with the Vulners.com vulnerability database. This script cross-references detected services with a vast repository of known vulnerabilities. To use it:

nmap -sV --script vulners <target>

Ensure you have the latest version of this script by updating your Nmap scripts database.

• Vulscan Script: Another potent script is vulscan, which enhances Nmap's capabilities by referencing multiple vulnerability databases. After installing vulscan, execute it as follows:

nmap -sV --script vulscan <target>

This script requires periodic updates to its databases to maintain accuracy.

2. Automating and Filtering Relevant Security Findings

To streamline vulnerability assessments and focus on critical issues, consider the following practices:

• Automated Scanning: Develop scripts or use scheduling tools (like cron jobs) to run Nmap scans at regular intervals. This ensures continuous monitoring of your network for emerging vulnerabilities.

• Filtering Results: Nmap allows you to filter scan results based on the Common Vulnerability Scoring System (CVSS) scores. For instance, to display only vulnerabilities with a CVSS score of 7.0 or higher:

nmap -sV --script vulners --script-args mincvss=7.0 <target>

This focuses the output on more severe vulnerabilities, aiding in prioritization.

3. Comparing Nmap to Dedicated Vulnerability Scanners

While Nmap, enhanced with NSE scripts, offers substantial vulnerability scanning capabilities, there are distinctions when compared to dedicated tools like Nessus or OpenVAS:

• Scope and Depth: Dedicated scanners often provide more comprehensive vulnerability databases and may detect a broader range of issues. Nmap's effectiveness depends on the quality and currency of its scripts and associated databases.

• Performance and Speed: Nmap is generally faster and less resource-intensive, making it suitable for quick assessments. Dedicated scanners might perform more in-depth analysis, which can be more time-consuming.

• Cost and Accessibility: Nmap is open-source and free, whereas tools like Nessus may require a subscription for full features.

4. Detailed Command-Line Example

To illustrate, here's how to perform a vulnerability scan using Nmap with the vulners script, focusing on high-severity issues:

nmap -sV --script vulners --script-args mincvss=7.0 192.168.1.1

In this command:

• -sV: Enables version detection to identify services running on open ports.

• --script vulners: Specifies the use of the vulners script for vulnerability detection.

• --script-args mincvss=7.0: Filters the results to include only vulnerabilities with a CVSS score of 7.0 or higher.

• 192.168.1.1: Represents the target IP address.

By integrating Nmap's NSE scripts into your security toolkit, you can conduct effective vulnerability assessments. Regular updates and a clear understanding of each script's functionality are essential for accurate and efficient scanning.