10 Nmap Scripts Every Ethical Hacker Must Know in 2026 (With Examples)

This article provides a technical guide to ten essential Nmap Scripting Engine (NSE) scripts used in professional penetration testing workflows, demonstrating how to move beyond basic port scanning to automated vulnerability detection and enumeration across multiple service categories including SMB, HTTP, FTP, SSL, and SMTP. The article argues that mastering these specific scripts—rather than all 600+ available NSE scripts—enables penetration testers to complete significant reconnaissance work in single commands while identifying critical vulnerabilities like EternalBlue, anonymous access, and dangerous HTTP methods. The material matters because it bridges the gap between foundational Nmap knowledge and professional assessment practices, offering concrete command examples and explaining wh

• The ten core NSE scripts replace manual workThe article identifies ten scripts that consistently appear across professional assessments and replace separate manual tools: smb-vuln-ms17-010 (EternalBlue detection), smb-enum-users (user enumeration), http-enum (directory discovery), http-methods (dangerous HTTP method detection), ssl-heartbleed (Heartbleed vulnerability), ftp-anon (anonymous FTP login), smtp-open-relay (mail relay misconfiguration), vulners (CVE lookup by version), http-title (web server fingerprinting), and ssh-auth-methods (authentication discovery). Each script automates a check that would otherwise take minutes per ho
• smb-vuln-ms17-010 detects EternalBlue safelyDespite being patched in 2017, EternalBlue (MS17-010) remains prevalent in production environments, as evidenced by the article's author account of finding three unpatched Windows 7 machines on an internal assessment in 2026. The script checks for SMB vulnerability without exploiting it, making it safe to run during vulnerability assessments using the command nmap -p 445 --script smb-vuln-ms17-010 TARGET, and can scan entire subnets with output indicating VULNERABLE state when present.
• Distinction between -sC and --script=vulnThe article explains that -sC runs all 'default' category scripts—safe, commonly useful enumeration like banner grabbing and HTTP title detection—while --script=vuln runs all 'vuln' category scripts that perform active vulnerability probing including EternalBlue detection, Heartbleed testing, and CVE checks. Vuln scripts are significantly more intrusive, generate more network traffic, and trigger more IDS alerts than default scripts, making the distinction critical for choosing appropriate scan intensity based on engagement type and authorization level.
• HTTP method detection reveals misconfigurationsThe http-methods script identifies potentially risky HTTP methods—PUT for file upload, DELETE for file deletion, and TRACE for Cross-Site Tracing (XST) attacks—revealing server misconfigurations. The article demonstrates expected output showing supported methods and labels potentially risky ones, enabling rapid identification of dangerous HTTP implementations without manual testing of each method.
• Service version enumeration enables CVE matchingThe vulners script queries the Vulners.com database to identify CVEs matching detected service versions, requiring version detection via the -sV flag. The article provides example output showing cpe:/a:vsftpd:vsftpd:2.3.4 matched to CVE-2011-2523 with CVSS scores, enabling prioritization by score (9.0+ findings prioritized). This automates the manual process of cross-referencing version numbers against CVE databases.
• SMTP open relay detection identifies spam risksThe smtp-open-relay script detects mail servers configured to forward email for arbitrary senders, creating infrastructure risks for spam and phishing campaigns. The article shows detection output indicating '14/16 tests' passed for open relay status and notes that enabled VRFY commands allow user enumeration, demonstrating how a single script identifies multiple related misconfigurations in mail infrastructure.
• Script categories determine safety and noise levelsNSE scripts are categorized as default (safe enumeration), safe (low risk), vuln (active probing), intrusive (network scanning), exploit (active exploitation), dos (denial of service), and brute (credential testing). The article emphasizes checking script category via nmap --script-help before execution and notes that default scripts are generally appropriate for production assessment while exploit and dos categories should never run without explicit authorization, understanding what the script does, and lab testing beforehand.
• Single combined command replaces multiple tool runsThe article demonstrates running all ten scripts against a target in one command: nmap -sV -p 21,22,25,80,443,445,3306 --script ftp-anon,ftp-vsftpd-backdoor,smb-vuln-ms17-010,smb-enum-users,http-enum,http-methods,http-title,ssl-heartbleed,smtp-open-relay,vulners TARGET, providing reconnaissance output that previously required running separate enumeration tools. The -oN flag saves results to file for report evidence, and the --script vuln category shortcut runs all vulnerability detection scripts simultaneously for comprehensive coverage.

Bottom line: Professional penetration testers differentiate themselves by mastering ten targeted NSE scripts that automate enumeration and vulnerability detection across common service categories—reducing assessment time significantly while finding critical vulnerabilities that persistent in production despite age. Before running any NSE script, verify authorization type matches script category (default scripts for standard scans, vuln scripts only for authorized assessments) and understand that dangerous mi