I am a network guy and not a “hacker” or whatever the official term is these days.
I’ve been learning how to use nmap as I think it’s a great tool for just keeping the network secure.
The thing is Id like to run the “default or (discovery and safe)” against a set of IP addresses.
In this case though I already know what the IP addresses are and exactly what ports they run.
There are also a lot of hosts (over 800).
If I wanted to run the “default or (discovery and safe)” script on this list of 800 IPs which of the following is correct.
Running nmap specifically at one IP with -p 80,443 --script “default or (discovery and safe)”. Does this just blindly run every script “default or (discovery and safe)”. Or does it only run the scripts that relate to port 80 and 443 only. Ignoring whois scripts etc as I know how to exclude those. Or do I have to only include the ones I’m interested in “http-*” etc.
I suppose the question is as to above if the script is for SMB then will it not bother with the script as it can see its for different ports. My end goal is to scan a list of IPs that I know are alive and I know the ports for with “default or (discovery and safe)” without running pointless scripts I don’t need to. Doing a script for each IP and list of ports in turn is fine if that’s what I need to do.
In this particular task Im mainly trying to see what a "script kiddie" would see generally from options in zenmap without me having to do long IP and TCP / UDP port scans (as I already know them) as well as the scripts. I just want to run the scripts as above and feed in the IPs and ports.
I find nmaps docs quite poor on explaining this as generally most people are doing the scan for IPs and ports at the same time as the scripts. Hopefully that all makes sense.