Beginner to intermediate · Self-paced, lab-based
Nmap Scripting Engine (NSE): Writing Your Own Scripts
From your first Lua line to a production-ready NSE script, in ten hands-on lessons.
Nmap finds what’s on the network. The Nmap Scripting Engine lets you teach it to ask better questions: fingerprint a custom service, audit a web server, check for a misconfiguration across ten thousand hosts. All from a small Lua script that reuses Nmap’s fast, parallel scanning core.
This course takes you from “I’ve run nmap -sV” to writing, debugging and hardening your own NSE scripts.
What you’ll be able to do
- Explain how an Nmap scan works and where scripts fit into it.
- Pick, run and tune existing NSE scripts, and read their source.
- Write confident, idiomatic Lua for the parts of the language NSE scripts actually use.
- Build scripts from scratch: rules, actions, script arguments, structured output.
- Use the NSE libraries (
stdnse,shortport,comm,http,vulnsand more). - Debug a misbehaving script with
-d,--script-traceand--packet-trace. - Make a script production-ready: safe, fast, well-documented and testable.
Who it’s for
Security engineers, pentesters, network and detection engineers, and anyone who already uses Nmap and wants to extend it. You should be comfortable on a command line. Programming experience helps but isn’t required: Lua is taught from scratch in lessons 3 and 4.
What you’ll need
- Nmap 7.9x or newer on Linux, macOS or Windows (check with
nmap --version). - A text editor.
- Python 3 for the small lab servers we use as safe targets. Optionally a standalone Lua 5.4 interpreter for practice.
Curriculum
Introduction to Nmap
What Nmap does, how a scan works from start to finish, and the options you'll use in every lab.
The Nmap Scripting Engine and its use cases
How NSE works, what scripts are used for, how to select and run them, and how to read an existing script.
Lua basics I: syntax and control flow
Variables, types, operators, conditionals and loops: the core of the language, with the gotchas that trip up newcomers.
Lua basics II: tables, strings, functions and errors
The tools you'll reach for in every script: tables, functions, string patterns, binary packing, error handling and modules.
Anatomy of an NSE script
The required fields, the four rule types, what host and port contain, and how return values become scan output.
The NSE library toolbox
The libraries you'll use in nearly every script: stdnse, shortport, nmap sockets, comm, http and vulns. Plus where to find the rest.
Scenario 1: fingerprinting a custom TCP service
Write a complete script from scratch: connect to an in-house service, parse its banner, and flag outdated versions across a network.
Scenario 2: auditing web servers over HTTP
Build a web hygiene checker: missing security headers and exposed sensitive files, with signature checks to avoid false positives.
Debugging NSE scripts
Find out why a script is silent, slow, or crashing, using -d, --script-trace, --packet-trace, debug logging and a repeatable checklist.
Making scripts production-ready
Harden a script for real networks: safety, performance, error handling, documentation, testing, distribution, and contributing upstream.