Detect Services with Nmap Scripts

You've spent hours mapping a target network, maybe even identified a few open ports — and then you hit the wall. A port is just a number, but the H in ethical hacking stands for how you use that number. Knowing that TCP/80 is open tells you little, but knowing it's running Apache httpd 2.4.49 makes you immediately think of path traversal CVE-2021-41773. In this lesson you'll learn how to use Nmap's scripting engine (NSE) to not just detect services but also fingerprint their exact versions — the detail that turns a scan into an exploitable finding.

The problem this lesson solves

Port scanning alone is surface-level reconnaissance. Every ethical hacker — and every CISO reviewing a pentest report — needs to know what is running, not just where a door is open. Automated tools like nmap -p- tell you that port 3306 is reachable, but they can't tell you whether it's MySQL 5.7 or MariaDB 10.6. That difference changes your attack plan entirely.

Without version detection, you're flying blind:

• You waste time brute-forcing credentials against the wrong service.
• You miss critical vulnerabilities tied to a specific version.
• Your report lacks the evidence a defender needs to patch.
• You can't prioritize targets when a network has hundreds of hosts.

Nmap's service/version detection combined with the Nmap Scripting Engine (NSE) solves this by actively interrogating services and extracting banners, handshake information, and even running vulnerability checks. The result: a precise fingerprint of every open service on your target.

Core concept / mental model

Think of service detection like a concierge at a luxury hotel. A port scan is a knock on a door — you know a room exists. Version detection is the concierge telling you the hotel brand, the room type, and the amenities. Nmap scripts are the specialized staff who can check the minibar for specific items (like open vulnerabilities) based on that brand knowledge.

The core building blocks:

• Service detection (-sV): Nmap sends a series of probes (null, malformed, and protocol-specific) to an open port, analyzes the responses, and matches them against a database of known service signatures.
• NSE scripts (-sC or --script): These are Lua programs that run after port and service detection, performing deeper checks, from version-specific exploit checks to brute-force attempts and information disclosure tests.
• Version hints (--script-args): You can pass arguments to scripts to customize behavior — e.g., providing a wordlist or a timeout.

Here's an analogy: the -sV flag is the way you get the name tag of the service; the NSE scripts are the resume of the service — they reveal education, skills, and weaknesses.

How it works step by step

1. Port discovery: First, Nmap finds open ports (e.g., -p or default top ports).
2. Service identification: For each open port, Nmap sends a series of probes (e.g., an HTTP GET request, an SSH banner grab) and compares the responses to its nmap-services database.
3. Version detection: The -sV flag enables the version detection engine, which uses a set of probe definitions (in nmap-service-probes). It captures banner text, response to malformed packets, and SSL/TLS handshake details to infer the exact product and version.
4. Script execution: Once a service is identified, Nmap runs any default scripts (-sC) or targeted scripts from the NSE script database (e.g., http-title, ssh2-enum-algos). These scripts can also probe without a prior service identification.
5. Output: The final report shows PORT, STATE, SERVICE, VERSION along with any script output.

This process is iterative: the more probes you send, the more accurate the fingerprint. However, the more actively you probe, the louder your scan — a consideration for stealth.

Hands-on walkthrough

Now let's get our hands dirty. We'll use a local lab (or a target you are authorized to scan — never scan a network you don't own or have explicit permission for). We'll start with a simple service detection scan and then layer in scripts.

Basic service detection

nmap -sV -p 22,80,443 scanme.nmap.org

Expected output snippet:

Starting Nmap 7.95 ( https://nmap.org ) at 2025-01-15 10:00 UTC
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up (0.11s latency).

PORT    STATE SERVICE    VERSION
22/tcp  open  ssh        OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0)
80/tcp  open  http       Apache httpd 2.4.7 ((Ubuntu))
443/tcp open  ssl/http   Apache httpd 2.4.7 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

The VERSION column is your gold mine. Note also the CPE (Common Platform Enumeration) — a standardized way to identify the software, which you can feed into vulnerability databases.

Add default scripts

nmap -sV -sC -p 22,80,443 scanme.nmap.org

The -sC runs the default set of safe NSE scripts. For an HTTP service, you'll see script output like:

| http-title: Go ahead and ScanMe!
|_http-server-header: Apache/2.4.7 (Ubuntu)

Target a specific script

If you want to check for a known vulnerability in that Apache version (hypothetically), you'd run:

nmap --script http-vuln-cve2017-5638 -p 80 scanme.nmap.org

Replace the script name with a real one from your Nmap script directory (e.g., ls /usr/share/nmap/scripts/). For example, http-headers is safe:

nmap --script http-headers -p 80 scanme.nmap.org

Output includes all HTTP response headers, which often leak version information.

Version detection with intensity

Nmap lets you control how aggressive version probing is with --version-intensity (0–9, default 7). High intensity sends more probes but is noisier:

nmap -sV --version-intensity 9 -p 3306 database.internal

Compare options / when to choose what

When to use what:

• Security assessment at scale: use -sV on all open ports, then -sC on critical hosts.
• Vulnerability research: pick a specific --script like http-vuln- or smb-vuln-.
• Stealthy recon: skip -sV, rely on banner grabbing via -sT (TCP connect) or -sS (SYN) plus manual nc checks.

Script categories to know

• default (safe, non-intrusive)
• auth (credential checks)
• brute (password brute-forcing)
• vuln (known-vulnerability checks)
• discovery (extra info like hostnames)
• safe (won't crash the service)

Run nmap --script-help <name> for documentation on a specific script.

Troubleshooting & edge cases

Script doesn't run or produces no output

• Check if the script exists: ls /usr/share/nmap/scripts | grep http.
• Permission: Running as root may be required for SYN scans, but most scripts run fine as a normal user.
• Target filtering: Some scripts require a service to be detected first. Use -sV to confirm.

Version detection returns "unknown"

• Try --version-intensity 9 or --version-light (fewer probes but faster) — sometimes the service doesn't respond to default probes.
• Use -sV --allports to probe all ports, not just open ones.

False positives

• Some services intentionally fingerprint themselves as something else (e.g., a honeypot). Cross-check with manual banner grabbing: nc -v target 80 and type HEAD / HTTP/1.0.

Firewall interference

• Stealth scans may succeed but version probes (which send unusual packets) get dropped. Use -sT (full TCP connect) if you have permission, or use -Pn to skip host discovery.

Script crashes or hangs

• Use --script-timeout 10s to limit script execution time.
• Some scripts are known to hang on certain services; use --script-args http-max-cache-size=100000 if memory is an issue.

What you learned & what's next

You've now mastered the critical skill of detect services and versions with nmap scripts. You can:

• Run basic service detection with -sV to see the exact software and version.
• Layer default NSE scripts to extract extra information like HTTP titles and headers.
• Target specific scripts for known vulnerabilities, and compare different Nmap options for speed, noise, and depth.
• Troubleshoot common issues like unknown versions, firewall traps, and hanging scripts.

This precision turns you from a port prober into a real security professional. The next logical step in your ethical hacking track is vulnerability scanning and exploitation — taking that exact version fingerprint and matching it against a vulnerability database (like Exploit-DB or CVE) to find a working exploit. You'll learn to chain these findings into a full penetration test.

Keep practicing. Build your own lab with vulnerable services (e.g., Metasploitable 2) and run these commands against it. The more you practice, the faster you'll recognize when a version matters and when it doesn't.

Pro tip: Always save your scan outputs (use -oA scan) so you can compare across time and demonstrate your methodology in reports.