> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/reconnaissance/active-reconnaissance-approach/nmap/script-scan.md).

# Script Scan

Nmap’s **Script Scan** is a feature that allows users to automate tasks using pre-written scripts or custom scripts written in **Lua**. These scripts help gather information about hosts, services, and vulnerabilities. Additionally, they can be used for tasks such as brute-force attacks, denial-of-service (DoS) attacks, and exploitation.

The **Script Scan** feature is activated using the `-sC` option or the `--script=default` option. This tells Nmap to run the **default script set**, which includes over **600 scripts** covering a variety of tasks, from information gathering to vulnerability detection.

All Script Available at this location in Linux: `/usr/share/nmap/scripts/`

* **Basic Script Scan**

```bash
nmap -v -p- -sT -sV -sC -T4 192.168.1.0/24
```

This command performs a **comprehensive scan** on all ports, detects services and versions, and runs the default scripts on the entire subnet (`192.168.1.0/24`).

* **Script Scan with OS Detection**

```bash
nmap -v -Pn -sT -sV -O -sC example.com
```

This command scans `example.com` while enabling OS detection (`-O`), service/version detection (`-sV`), and running default scripts (`-sC`).

* **Targeted Vulnerability Scan**

```bash
nmap -v -Pn -sT -sV -O --script=http-vuln-cve2006-3392.nse example.com
```

This command performs a scan on `example.com`, specifically using the `http-vuln-cve2006-3392.nse` script to check for vulnerabilities related to **CVE-2006-3392**.