> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/web/web-discovery/nmap-http-nse-scripts.md).

# Nmap HTTP NSE Scripts

The Nmap Scripting Engine (NSE) is one of Nmap's most powerful and flexible features. It allows users to write (and share) simple scripts to automate a wide variety of networking tasks. Those scripts are then executed in parallel with the speed and efficiency you expect from Nmap. Users can rely on the growing and diverse set of scripts distributed with Nmap, or write their own to meet custom needs.

The scripts are located in `/usr/share/nmap/scripts`.

## HTTP Enumeration <a href="#http-enumeration" id="http-enumeration"></a>

Run all HTTP-related enumeration scripts

```bash
nmap -v -p80 --script http*enum* $TARGET_IP
```

### Display comments <a href="#references" id="references"></a>

To extract and output HTML and JavaScript comments from HTTP responses by crawling the web site. Default values are maxdepth=3 and maxpagecount=20.

```bash
nmap -v -p80 --script http-comments-displayer $TARGET_IP
```

To extract and output HTML and JavaScript comments with a maxdepth of 5

```bash
nmap -v -p80 --script http-comments-displayer $TARGET_IP --script-args maxdepth=5
```

To extract and output HTML and JavaScript comments from one or more specific pages

```bash
nmap -v -p80 --script http-comments-displayer $TARGET_IP --script-args singlepages={/login/login.php}
```

To extract and output HTML and JavaScript comments from one or more specific pages with 5 lines of context before each comment

```bash
nmap -v -p80 --script http-comments-displayer $TARGET_IP --script-args singlepages={/login/login.php} --script-args context=5
```

### List of Scripts <a href="#references" id="references"></a>

List of HTTP-related NSE scripts:

<table><thead><tr><th width="239">Name</th><th>Description</th></tr></thead><tbody><tr><td><a href="https://nmap.org/nsedoc/scripts/http-comments-displayer.html">http-comments-displayer</a></td><td>Extracts and outputs HTML and JavaScript comments from HTTP responses.</td></tr><tr><td><a href="https://nmap.org/nsedoc/scripts/http-enum.html">http-enum</a></td><td>Enumerates directories used by popular web applications and servers.</td></tr><tr><td><a href="https://nmap.org/nsedoc/scripts/http-methods.html">http-methods</a></td><td>Finds out what options are supported by an HTTP server by sending an OPTIONS request.</td></tr><tr><td><a href="https://nmap.org/nsedoc/scripts/http-robots.txt.html">http-robots.txt</a></td><td>Checks for disallowed entries in <code>/robots.txt</code> on a web server.</td></tr><tr><td><a href="https://nmap.org/nsedoc/scripts/http-security-headers.html">http-security-headers</a></td><td>Checks for the HTTP response headers related to security given in OWASP Secure Headers Project.</td></tr><tr><td><a href="https://nmap.org/nsedoc/scripts/http-userdir-enum.html">http-userdir-enum</a></td><td>Attempts to enumerate valid usernames on web servers running with the mod_userdir module or similar enabled.</td></tr><tr><td><a href="https://nmap.org/nsedoc/scripts/http-wordpress-enum.html">http-wordpress-enum</a></td><td>Enumerates themes and plugins of Wordpress installations.</td></tr></tbody></table>

## **References**

NSEDoc Reference Portal: <https://nmap.org/nsedoc/index.html>

NSE Categories: <https://nmap.org/nsedoc/categories/>

NSE Scripts: <https://nmap.org/nsedoc/scripts/>