> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/web-discovery/nmap-http-nse-scripts.md). # Nmap HTTP NSE Scripts The NSE scripts are located in the /usr/share/nmap/scripts directory. ## HTTP Discovery To run all discovery scripts on common HTTP ports ```bash nmap -v -p 80,443,8080 --script "http-* and discovery" $TARGET_IP ``` ## HTTP Enumeration To run basic enumeration on common HTTP ports ```bash nmap -v -p 80,443,8080 --script http-enum $TARGET_IP ``` And specifically for Wordpress ```bash nmap -v -p 80,443,8080 --script http-wordpress-enum $TARGET_IP ``` ## HTTP Vulnerabilities To run all vulnerability scripts on common HTTP ports ```bash nmap -v -p 80,443,8080 -sV --script vuln $TARGET_IP ``` ## List of HTTP Scripts Nmap scripts are stored in the directory `/usr/share/nmap/scripts`. List of HTTP-related NSE scripts:

Name	Description
http-auth	Retrieves the authentication scheme and realm of a web service that requires authentication.
http-backup-finder	Spiders a website and attempts to identify backup copies of discovered files. It does so by requesting a number of different combinations of the filename (eg. index.bak, index.html~, copy of index.html).
http-comments-displayer	Extracts and outputs HTML and JavaScript comments from HTTP responses.
http-enum	Enumerates directories used by popular web applications and servers.
http-git	Checks for a Git repository found in a website's document root /.git/) and retrieves as much repo information as possible, including language/framework, remotes, last commit message, and repository description.
http-methods	Finds out what options are supported by an HTTP server by sending an OPTIONS request.
http-robots.txt	Checks for disallowed entries in `/robots.txt` on a web server.
http-security-headers	Checks for the HTTP response headers related to security given in OWASP Secure Headers Project.
http-vhosts	Searches for web virtual hostnames by making a large number of HEAD requests against http servers using common hostnames.
http-waf-detect	Attempts to determine whether a web server is protected by an IPS (Intrusion Prevention System), IDS (Intrusion Detection System) or WAF (Web Application Firewall) by probing the web server with malicious payloads and detecting changes in the response code and body.
http-wordpress-enum	Enumerates themes and plugins of Wordpress installations.

## Script Help You can get help about a specific NSE script with ```bash nmap --script-help http-enum ``` To get help about several scripts you can use wildcards such as ```bash nmap --script-help *http* ``` Or you can get help about all scripts in a specific category ```bash nmap --script-help discovery ``` ## Resources NSEDoc Reference Portal: NSE Categories: NSE Scripts: