Accordly with the [nmap documentation][1] in "Example 9.2. script help", the nmap's parameter that displays help about the script is: nmap --script-help <filename.nse> Namely: nmap --script-help http-sql-injection.nse If you look at [NSE documentation][2] written by own Nmap's creator: > **3.1. description Field** > > The description field describes what a script is testing for and any importantnotes the user should beaware of. > Depending on script complexity, the description may vary from a few > sentences to a few paragraphs. The first paragraph should be a brief > synopsis of the script function suitable for stand-alone presentation > to the user. Further paragraphs may provide much more script detail. Fyodor explain that the "description" field is used to describe everything about the complexity that the script itself might have. So, go ahead and look deeper into how the script was made: $ vi /usr/share/nmap/scripts/http-sql-injection.nse ... 11 description = [[ 12 Spiders an HTTP server looking for URLs containing queries vulnerable to an SQL 13 injection attack. It also extracts forms from found websites and tries to identify 14 fields that are vulnerable. 15 16 The script spiders an HTTP server looking for URLs containing queries. It then 17 proceeds to combine crafted SQL commands with susceptible URLs in order to 18 obtain errors. The errors are analysed to see if the URL is vulnerable to 19 attack. This uses the most basic form of SQL injection but anything more 20 complicated is better suited to a standalone tool. 21 22 We may not have access to the target web server's true hostname, which can prevent access to 23 virtually hosted sites. 24 ]] This explain why the `http-sql-injection.nse` script do not shown "usage options" whether that's what you expected to see. ---------- The NSE scripts has a tradition to include "usage options" inside a comments. Such thing that was documented on the section "**8.1 The Head**": > Next comes NSEDoc information. This script is missing the common > @usage and @args tags since it is so simple, but it does have an > NSEDoc @output tag: > > --- > --@output > -- 21/tcp open ftp ProFTPD 1.3.1 > -- |_ auth-owners: nobody > -- 22/tcp open ssh OpenSSH 4.3p2 Debian 9etch2 (protocol 2.0) > -- |_ auth-owners: root > -- 25/tcp open smtp Postfix smtpd > -- |_ auth-owners: postfix > -- 80/tcp open http Apache httpd 2.0.61 ((Unix) PHP/4.4.7 ...) > -- |_ auth-owners: dhapache > -- 113/tcp open auth? > -- |_ auth-owners: nobody > -- 587/tcp open submission Postfix smtpd > -- |_ auth-owners: postfix > -- 5666/tcp open unknown > -- |_ auth-owners: root Since the documentation does not explicitly show the use of "@usage", look yourself in `/usr/share/nmap/scripts/`: $ grep -iR -A5 "@usage" /usr/share/nmap/scripts/ /usr/share/nmap/scripts/ajp-brute.nse:-- @usage /usr/share/nmap/scripts/ajp-brute.nse--- nmap -p 8009 <ip> --script ajp-brute /usr/share/nmap/scripts/ajp-brute.nse--- /usr/share/nmap/scripts/ajp-brute.nse--- @output /usr/share/nmap/scripts/ajp-brute.nse--- PORT STATE SERVICE /usr/share/nmap/scripts/ajp-brute.nse--- 8009/tcp open ajp13 ... [1]: https://nmap.org/book/nse-usage.html [2]: https://media.blackhat.com/bh-us-10/whitepapers/Vaskovitch/BlackHat-USA-2010-Fyodor-Fifield-NMAP-Scripting-Engine-wp.pdf