Writing organisation-specific audit scripts with the Nmap scripting engine
With enough Lua and NSE libraries you write safe scripts that check your organisation’s configuration rules, test them, produce structured output and share them with your team under version control.
Level 401 · 15 lessons · 15 practice labs
Lessons
Lua and the shape of NSE
- Why your own script: organisation-specific configuration rules
- Enough Lua for NSE: variables, tables, functions
- Anatomy of a script: head, rule and action
- NSE libraries: http, shortport, stdnse
- Short task: write your first script that prints the version when a port is open
Audit scripts
- Flagging service banners that leak versions
- A script that audits HTTP security headers
- A script that detects default installation pages
- Finding services that break the organisation’s TLS policy
- Short task: finish the script that reports missing security headers
Quality and rollout
- A safe script: timeouts, rate and error handling
- Structured output: results that fit XML and JSON
- Testing scripts against lab targets
- Sharing and versioning scripts within the team
- Capstone: write a set of NSE scripts that audit your organisation’s configuration standard
Practice labs
- Write your first script that prints the version when a port is open: Write a script with header, rule and action sections and show it prints the version on an open port of the lab server.
- Fix the rule of a script that runs on the wrong ports: A team script's rule fires on every port; fix it with the library helpers so it runs only on the intended services.
- Structure script output with a Lua table: Collect the fields from a service in a Lua table, make the printed fields selectable via a script argument and test it.
- Write a script that flags version-leaking banners: Write a script that flags services whose banner contains a version number and verify the result on three lab services.
- Hide version-leaking banners and re-audit with your script: Remove the version from the web, mail and FTP banners on Pusulaya Sigorta's servers and show they are clean with your own script.
- Write a script that detects default installation pages: Write a script that checks known default-page signatures, find the two forgotten install pages in the lab and add the removal note.
- Complete the script that reports missing security headers: Finish the half-written script and list the security headers missing on each lab site.
- Feed the company header policy to the script via arguments: Define Narçiçeği Eczaneleri's header policy as script arguments and report the sites that break it with reasons.
- Close the header gaps and confirm with your script: Add the missing headers your script found to the web server configuration, rerun it and put the before-and-after output in the report.
- Write a script that checks the minimum TLS version: Write a script that flags services accepting connections below the policy's minimum TLS version and test it in the lab.
- Write a script that checks certificate rules: Write a script that checks key length, expiry and signature algorithm rules and list the certificates that break policy.
- Find, fix and re-audit services that break the TLS policy: Turn Demirsu Enerji's TLS policy into a script, fix the two non-compliant lab services and prove compliance with the script output.
- Add timeouts and error handling to a script: Add a timeout and error handling to a script that hangs on an unresponsive service and show its behaviour on a slow lab target.
- Convert script results to structured output: Change a plain-text script to emit structured output and verify the result exported from XML to JSON.
- Test your script set against lab targets and version it: Test three scripts that check the company standard against compliant and non-compliant lab targets and write the expected-result table and release note.
About this course
With enough Lua and NSE libraries you write safe scripts that check your organisation’s configuration rules, test them, produce structured output and share them with your team under version control.
What you will learn
- Lua and the shape of NSE
- Audit scripts
- Quality and rollout
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.