‫OK, so let's get to it.
‫NSA is activated with the s advocacy option or script, if you wish to specify a custom set of scripts.
‫Script scanning is normally done in combination with a port scan because Grip's may be run or not run
‫depending on the port states found by the scan.
‫You can use S.
‫C to perform a script scan using the default set of scripts, it is equivalent to script equals default.
‫Now, wait a second now, what is this default?
‫Well, it is one of the categories of unmap script.
‫Let me show you.
‫And map scripting engine, NSC script define a list of categories that they belong to.
‫So currently defined categories are off broadcast brute default.
‫Discovery does exploit external foser, intrusive malware, safe version and vom category names are
‫not case sensitive.
‫So let's give you a little detail.
‫Default scripts are the default set and are run when using the SRK see, rather than listing scripts
‫with script.
‫This category can also be specified explicitly, like any other, using script equals default.
‫Off script deal with authentication credentials or coincidentally bypassing them on the target system.
‫Examples include Oracle enum users.
‫Bruta script used brute force attacks to guess authentication credentials of a remote server and map
‫contained scripts for brute, forcing dozens of protocols including HTTP, brute, oracle, brute,
‫S&P, bruta, etc..
‫DOS scripts may cause a denial of service.
‫Sometimes this is done to test vulnerability to a denial of service method, but more commonly it's
‫an undesired by necessary side effect of testing for a traditional vulnerability.
‫These tests sometimes crash vulnerable services.
‫Export scripts aim to actively exploit some vulnerability, examples include HTP, shell shock Allscripts,
‫which weren't designed to crash services, use large amounts of network bandwidth or other resources,
‫or exploit security holes that are usually categorized as safe.
‫Intrusive scripts are those that cannot be classified in the safe category because the risks are just
‫too high, that they're going to crash the target system, use up significant resources on the target
‫host such as bandwidth or CPU time or otherwise be perceived as malicious by the target system administrators.
‫Malware scripts test whether the target platform is infected by malware or back doors.
‫Version scripts are an extension to the version detection feature and cannot be selected explicitly,
‫they're selected to run only if version detection that's s uppercase V was requested and VOLLEN scripts
‫check for specific known vulnerabilities and generally only report results if they're found.
‫You can't alternatively use script parameter to run a script scan using the comma separated list of
‫file names, script categories and directories.
‫Each element in the list may also be a boolean expression describing a more complex set of scripts.
‫For example, if you use script parameter using the default and safe expression, the scripts which
‫are in both default and safe categories, run that makes it.
‫Script update, DB option updates, the script database found in scripts script that DB, which is used
‫by Unmap to determine the available default scripts and categories.
‫It's only necessary to update the database if you have added or removed Tennesee scripts from the default
‫scripts directory or if you changed the categories of any script.
‫This option is used by itself without arguments.
‫OK, so let's see some of these scripts and try to use them.
‫Open a terminal screening, Colly.
‫To find out the scripts, use the locate the next command, since the file extension of unmap scripts
‫are NSC type, locate asterisked NSC and hit enter, it will locate the files which end with NSC.
‫This is where the unmap scripts are located in COLLY by default.
‫Go to the folder using the CD Command, iSelect the path and press the middle button on my mouse to
‫copy and paste it and hit enter.
‫Now let's look at the script DB file first, which is a script database used by EMAP.
‫It's in this folder.
‫I use less command to look at the content of the file.
‫Every row contains a script, file, name and its categories.
‫So now we can see the usage of unmap scripts.
‫I want to try S.H. scripts on my medicine voidable VM first with the help of Linux grep command.
‫Once again, I want to list the SS H script.
‫Here are the scripts that have the S.H. word in their names.
‫To analyze the content of a script, I use less command.
‫Now let's look at a file, for example, S.H. host KeyData and the script file has a description.
‫A used section and many more lines.
‫I want to show you the category section of the script in the last command, you can use it key to search
‫a word slash type Kate and hit enter.
‫Here it found Kate in the word duplicate.
‫This is not what we're looking for.
‫So press and key to find the next Kate word again, duplicate press and once again and we found the
‫category section.
‫Alternatively, you can use this script help and map parameter to get help about an end map, script
‫type and map.
‫And then this group name file extension is optional here, it's OK if you don't use the extension.
‫And here's a brief summary of the S.H. host case, script, script, name a link to learn more about
‫it and the description of the script.
‫Now, look at the description of the S.H. Husky script.
‫It shows the target S.H. Server's key fingerprint and with high enough Abassi level the public key itself.
‫Now let's run a few unmap commands and use some scripts, prepare the Inmet command DCPI since Skåne.
‫Don't forget to define support of your interest.
‫First, I want to run the default SSA scripts using the surrogacy parameter.
‫SSA Koskie is the default script for S.H. Service, and here are the Target SSA servers, key fingerprints
‫and the description of the script, we saw that if the veracity level is high enough, the script will
‫show the public key itself to see it.
‫I want to run the map command again, but this time I use the triple V to increase the verbosity level.
‫Now we have the public keys as well as the fingerprints.