diff --git a/docs/refguide.xml b/docs/refguide.xml index 21e1bf5ef..453f291b7 100644 --- a/docs/refguide.xml +++ b/docs/refguide.xml @@ -2013,6 +2013,12 @@ way. at . in . + + Scripts are not run in a sandbox and thus could accidentally or + maliciously damage your system or invade your privacy. Never run + scripts from third parties unless you trust the authors or have + carefully audited the scripts yourself. + The Nmap Scripting Engine is described in detail at @@ -2036,42 +2042,129 @@ way. - + + + + -Runs a script scan (like ) using the comma-separated list of -script categories, individual scripts, or directories containing -scripts, rather than the default set. Nmap first tries to interpret the -arguments as categories, then (if that fails) as files or -directories. A script or directory of scripts may be specified as an -absolute or relative path. Absolute paths are used as -supplied. Relative paths are searched for in the following places -until found:data filesdirectory search orderscripts, location of ---datadir/; -$NMAPDIR/;NMAPDIR environment variable -~/.nmap/ (not searched on Windows);.nmap directory -NMAPDATADIR/ orNMAPDATADIR -./. A scripts/ subdirectory -is also tried in each of these. -If a directory is specified and found, Nmap loads all NSE -scripts (any filenames ending with .nse) from that -directory. Filenames without the nse extension are -ignored. Nmap does not search recursively into subdirectories to find -scripts. If individual file names are specified, the file extension -does not have to be nse. + +Runs a script scan using the comma-separated list of filenames, script +categories, and directories. Each element in the list may also be a +Boolean expression describing a more complex set of scripts. Each +element is interpreted first as an expression, then as a category, and +finally as a file or directory name. The special argument +all makes every script in Nmap's script database +eligible to run. + + +File and directory names may be relative or absolute. Absolute names are +used directly. Relative paths are looked for in the following places +until found: +data filesdirectory search orderscripts, location of + + +$NMAPDIRNMAPDIR environment variable +~/.nmap (not searched on Windows).nmap directory +NMAPDATADIRNMAPDATADIR +the current directory + +A scripts subdirectory is also tried in each of +these. + + + +When a directory name is given, Nmap loads every file in the directory +whose name ends with .nse. All other files are +ignored and directories are not searched recursively. When a filename is +given, it does not have to have the .nse extension; +it will be added automatically if necessary. + + +script databasescript.db +scripts, location of Nmap scripts are stored in a scripts subdirectory of the Nmap data directory by default +). For efficiency, scripts are indexed in +a database stored (see ). (see ). For efficiency, scripts are indexed in a database stored -in scripts/script.db.script.db -which lists the category or categories in which each script belongs. -Give the argument all to execute all scripts in the -Nmap script database. +in scripts/script.db,script.db +which lists the category or categories in which each script belongs. -Malicious scripts are not run in a sandbox and thus could damage your system or invade your privacy. Never run scripts from third parties unless you trust the authors or have carefully audited the scripts yourself. + wildcardsin script selection + + When referring to scripts from script.db by + name, you can use a shell-style ‘*’ + wildcard. + + + + + nmap --script "http-*" + + Loads all scripts whose name starts with + http-, such as + http-auth.nse and + http-open-proxy.nse. The argument to + had to be in quotes to protect the + wildcard from the shell. + + + + + Boolean expressions in script selection + + More complicated script selection can be done using the + and, or, and + not operators to build Boolean expressions. The + operators have the same + precedence + as in Lua: not is the highest, followed by + and and then or. You can + alter precedence by using parentheses. Because expressions contain + space characters it is necessary to quote + them. + + + + + nmap --script "not intrusive" + + Loads every script except for those in the + intrusive category. + + + + nmap --script "default or safe" + + This is functionally equivalent to + nmap --script "default,safe". It loads all + scripts that are in the default category or + the safe category or both. + + + + nmap --script "default and safe" + + Loads those scripts that are in + both the default and + safe categories. + + + + nmap --script "(default or safe or intrusive) and not http-*" + + Loads scripts in the default, + safe, or intrusive + categories, except for those whose names start with + http-. + + +