HTB Academy - NSE Scripts
HTB Academy - NSE Scripts: Use Nmap Scripting Engine (NSE) to enumerate a target, discover interesting HTTP paths, and recover the flag. I played with different script categories and then ran http-enum to quickly surface web paths like /robots.txt, which led to the flag. • HackTheBox • nmap
🎯 Objective
Use Nmap Scripting Engine (NSE) to enumerate a target, discover interesting HTTP paths, and recover the flag. I played with different script categories and then ran http-enum to quickly surface web paths like /robots.txt, which led to the flag.
🧠 NSE in a Nutshell
NSE lets me run Lua scripts alongside a scan to query or test specific services. Scripts are grouped into 14 categories so I can choose safe vs. aggressive behavior depending on scope.
Categories (cheat sheet)
| Category | What it focuses on |
|---|---|
auth | Finding authentication creds / auth mechanisms |
broadcast | LAN discovery via broadcast (hosts auto-added to scan) |
brute | Brute-force login attempts against services |
default | The scripts used by -sC (conservative defaults) |
discovery | Service enumeration beyond banners |
dos | DoS checks (rarely used; can harm services) |
exploit | Attempts to exploit known vulns |
external | Leverage external services/APIs for analysis |
fuzzer | Send varied inputs to find parsing/logic bugs (slow) |
intrusive | May be disruptive or high‑impact |
malware | Indicators of malware / backdoors |
safe | Low‑impact, defensive enumeration |
version | Deeper service fingerprinting |
vuln | Check for specific, known vulnerabilities |
Where scripts live
ls /usr/share/nmap/scripts
# e.g. acarsd-info.nse, address-info.nse, afp-*.nse, http-*.nse, smb-*.nse, ...I like to grep for families:
ls /usr/share/nmap/scripts/*http* # all HTTP-related NSE scripts🧭 Run http-enum and pivot from findings
I ran http-enum against the target. It fingerprints common files/dirs and server frameworks.
nmap 10.129.2.49 --script http-enumOutput (excerpt):
Starting Nmap 7.92 ( https://nmap.org ) at 2022-10-26 06:18 EDT
Nmap scan report for 10.129.2.49
Host is up (0.024s latency).
Not shown: 993 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
| http-enum:
|_ /robots.txt: Robots file
110/tcp open pop3
139/tcp open netbios-ssn
143/tcp open imap
445/tcp open microsoft-ds
31337/tcp open Elite
Nmap done: 1 IP address (1 host up) scanned in 3.02 secondsScreenshot from my run:
🔎 Pull robots.txt and follow the breadcrumbs
Once /robots.txt popped, I fetched it and chased the disallowed path(s). One of those endpoints exposed the flag.
curl -s http://10.129.2.49/robots.txt
# Disallow: /<interesting-path>
curl -s http://10.129.2.49/<interesting-path> | headFlag
<PASTE_FLAG_HERE>🧾 Handy NSE one‑liners (copy/paste)
# Default & safe scripts with versions on common ports
sudo nmap -sC -sV -p 22,80,110,139,143,445 10.129.2.49
# Broad HTTP script sweep (safe-ish)
sudo nmap -p80 --script "http-* and safe" 10.129.2.49
# Vulnerability checks (scoped/approved)
sudo nmap -p80 --script "http-vuln* or vuln" 10.129.2.49
# List what a category would run
nmap --script-help default
nmap --script-help vuln🧪 Tips
- Start with
safe/defaultbeforeintrusive/exploit/dosin a client network. http-enumis a fast win; follow up withhttp-title,http-headers,http-methods.- Pair with
-sVso version and script results reinforce each other.
🔒 Defense (notes to self)
- Avoid leaking sensitive paths in
robots.txt. - Lock down default web dirs; sanitize directory listings.
- Monitor unusual HTTP enumeration patterns; rate-limit where possible.
Summary: NSE made it trivial—
http-enum→/robots.txt→ flag.