Can anyone answer which scripts are used when the -A flag is used?

The answers I've found all point to the generic -A: Enables OS detection and Version detection, Script scanning and Traceroute. help info which doesn't answer which scripts are used.

Is it equivalent to having --script="(default and safe)" or something else?

1 Answer 1


Yes, it is identical.

You can verify this by looking at nmap.cc, which parses the arguments. The handler for -A sets delayed_options.advanced to true, which in turn sets o.script to true. This is identical to the -sC flag, which also sets o.script to true.

As for which scripts are run, this depends on the nmap version. By default, it runs scripts that nmap considers "safe"

  • Thanks, It was just something I'd been wondering about, much appreciated
    – akaBase
    Commented Apr 17, 2020 at 13:15
  • By default, Nmap runs scripts in the "default" category only. Commented Apr 28, 2020 at 18:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .