Skip to content

Nmap Vulnerability Scanner

nmap_vulns runs Nmap NSE vulnerability scripts against services that hxEASM already knows about and converts script results into normal vulnerability findings.

Purpose

Use this plugin when you want NSE-based vulnerability validation after service discovery has already identified open ports.

nmap and nmap_vulns have different jobs:

Plugin Purpose
nmap Service discovery and fingerprinting. It creates or updates service assets.
nmap_vulns Vulnerability checks against known services. It creates vulnerability findings.

nmap_vulns is registered and available in custom profiles and manual execution, but it is not included in any built-in scan profile.

Supported Inputs

Supported asset types:

  • service
  • ip
  • domain
  • subdomain

The plugin prefers service assets such as:

1.2.3.4:443/tcp

It also accepts host:port inputs from manual execution and treats them as TCP. For service assets, it extracts host, port, and protocol and runs Nmap only against that known port.

For ip, domain, or subdomain inputs, the MVP does not perform a broad port scan. If the scan scope does not already contain related service assets, the plugin exits successfully with raw output explaining that it was skipped.

Execution Modes

  • profile_scan
  • manual_scan
  • retry

Manual execution is useful from a specific service asset. Running it manually from an IP, domain, or subdomain without known service context will skip cleanly.

Configurable Options

The plugin exposes settings through Settings -> Scans -> Plugins.

Option Type Allowed values Default CLI mapping
script_preset select vuln, safe_vuln vuln --script <preset>
timing select T2, T3, T4 T3 -T2, -T3, or -T4
max_retries number 0-5 1 --max-retries <value>
host_timeout_seconds number 10-300 60 --host-timeout <value>s

script_preset=vuln runs the Nmap vuln script category. script_preset=safe_vuln uses the conservative expression vuln and safe.

Arbitrary NSE script names, custom NSE script paths, and arbitrary Nmap CLI flags are intentionally not supported yet.

Safe Command Construction

The wrapper builds an argument slice for exec.CommandContext; it does not construct a shell string.

Example command shape:

nmap -Pn -sV --script vuln -T3 --max-retries 1 --host-timeout 60s -p 443 -oX - 1.2.3.4

Each option value is validated before execution:

  • script preset must be one of the registered presets
  • timing must be T2, T3, or T4
  • retries must be between 0 and 5
  • host timeout must be between 10 and 300 seconds

Vulnerability Output

The plugin parses Nmap XML output and creates normalized vulnerability entities from NSE script results.

Where available, it extracts:

  • host
  • port
  • protocol
  • service name
  • NSE script ID
  • script output excerpt
  • CVE IDs

Finding metadata is used by the Vulnerabilities page to show affected host, port, protocol, service, script ID, and CVEs. It includes:

{
  "source_plugin": "nmap_vulns",
  "script_id": "http-vuln-cve2021-41773",
  "port": "443",
  "protocol": "tcp",
  "service": "https",
  "cves": ["CVE-2021-41773"]
}

Severity is medium when a CVE is present and info when the script output has no CVE. The plugin does not invent CVEs or CVSS values.

Adding to a Custom Profile

Create or edit a profile in Settings -> Scans -> Scan Profiles and place nmap_vulns after service discovery.

Recommended order:

subfinder -> dnsx -> naabu -> nmap -> nmap_vulns

nmap_vulns needs known service assets. If it runs before naabu/nmap has produced services, it will skip rather than scanning all ports.

Test Mode

When EASM_TEST_MODE is enabled, nmap_vulns returns a deterministic test vulnerability for 127.0.0.1:443 and includes simulated command/options in raw output.