Mastering the Nmap Scripting Engine

Scan phases and NSE

Nmap scans are divided into several phases but NSE is only involved in three of them: pre-scanning, script scanning, and post-scanning. The execution rule defined by a function in the NSE script determines whether it runs in any of those phases.

Note

To learn more about the phases of Nmap scans, check out Appendix A, Scan Phases.

NSE script rules

NSE scripts can have one of four different types of execution rule:

• prerule
• postrule
• portrule
• hostrule

Let's review some examples of these different script rules. This will also help you learn to debug scripts for those times when you run into problems:

• prerule(): The following is a snippet from the targets-sniffer.nse NSE script. It illustrates how we can use a prerule function to check whether ...