nmap Commandline Options and NSE Question

[thorin]

Does anyone know if you can specify (and have nmap adhere to) --script=safe along with -A?

"-A: Enables OS detection and Version detection, Script scanning and Traceroute"

However -A assumes --script=default and it seems that --script=safe is a slightly larger list of NSEs.

To put my question another way does -A override --script=?

The closest detail I could find was:
Usage and Examples

Another option which affects the scripting engine is -A. The aggressive Nmap mode implies the -sC option.

Sadly this is terribly non-specific.

[purehate]

You can create a directory with only the scripts you want to run. Not sure if that helps.


--datadir
$NMAPDIR
~/.nmap (not searched on Windows)
NMAPDATADIR
the current directory
A scripts subdirectory is also tried in each of these.

When a directory name is given, Nmap loads every file in the directory whose name ends with .nse. All other files are ignored and directories are not searched recursively. When a filename is given, it does not have to have the .nse extension; it will be added automatically if necessary.

or looks like you can ONLY load scripts which are both in two catagories.
nmap --script "default and safe"
Loads those scripts that are in both the default and safe categories.

[thorin]

Thanks pureh@te, I like the idea of "default and safe" though I'd probably go with "default or safe". I'm still trying to figure out of -A overrides --script though (or vice versa), I don't have access to a system that pops a result on the safe category that isn't in the default category.

So I got in-touch with someone who is heavily into NSE development and got the following reply:

...arguments to --script take precedence over -A. So if you do --script=safe, it'll run all the safe scripts.

[Archangel-Amael]

Thanks for the response thorin.

[skidmarq]

Very informative stuff, thanks guys!