In previous post about Vulners [vulnerability detection plugins for Burp and Google Chrome](), I mentioned that it would be great to have a plugin for some free publicly available tool, like Nmap. And guys from the Vulners Team have recently released Nmap plugin. Isn't it awesome? ![🙂](https://s.w.org/images/core/emoji/2.4/72x72/1f642.png) ![Vulners Nmap vulnerability detection plugin](https://avleonov.com/wp-content/uploads/2017/12/vulners_nmap_vulnerability_detection_plugin.png) To detect vulnerabilities with Vulners Nmap plugin, you need to download the script and run it like this: `$ wget -O vulners.nse https://raw.githubusercontent.com/vulnersCom/nmap-vulners/master/vulners.nse $ nmap -sV --script vulners.nse corporation.com` The output you can see on the screenshot above. First of all, I need to say that** it's not the full analogue** of the plugins for Burp and Google Chrome. In the current version it doesn't analyse the content and headers of the site. It doesn't detect vulnerabilities of standard Web applications. From the other hand, this plugin can detect vulnerabilities of network services, that plugins for Burp and Chrome obviously won't detect. The plugin process the output of Nmap. If Nmap will detect service version as CPE id, it will make a request Vulners Burp API (described in [previous post]()) to get list of vulnerabilities and exploits. This CPEs ids you can see if you set Nmap output format to XML. `$ nmap -sV -oX test.xml corporation.com $ cat test.xml ` Output: `... **cpe:/a:openbsd:openssh:6.6.1** **cpe:/a:exim:exim:4.89** ...` So, the plugin shows vulnerabilities for [https://vulners.com/api/v3/burp/software?software=cpe:/a:exim:exim:&version=4.89&type=cpe]() If service version is available only in human-readable format, plugin will try to make software-type requests using _port.version.__product_ and _port.version.version_ As you can see, there is no magic in this. Script [vulners.nse]() rather compact and can be used for education purposes. Pros: * It works, it's free and can be easily automated. ![😉](https://s.w.org/images/core/emoji/2.4/72x72/1f609.png) * Numerous Nmap users intuitively understand how to use the plugin. * To run the script you only need installed nmap. No dependencies and additional components. Cons: * Nmap uses Lua as a scripting language. It is quite readable, but very unusual. I think Lua is the main reason why the number of NSE plugins is relatively small. Of course, you can add the ability to analyse http content and headers in the plugin, but in python it would be much easier. And there are more potential developers who can make it. My opinion, it's better use Nmap as an utility for detecting active hosts, open ports and services. Than export this data in xml and make additional processing using some external scripts. It is be better from the point of view licenses, as far as [Nmap is not fully GPL](), and also leaves the possibility to switch to another tool, if it will be necessary. ![](http://feeds.feedburner.com/~r/avleonov/~4/oznZU6a-U7o)