| Category | Description | |
| auth | Determination of authentication credentials. | |
| broadcast | Scripts, which are used for host discovery by broadcasting and the discovered hosts, can be automatically added to the remaining scans. | |
| brute | Executes scripts that try to log in to the respective service by brute-forcing with credentials. | |
| default | Default scripts executed by using the -sC option. | |
| discovery | Evaluation of accessible services. | |
| dos | These scripts are used to check services for denial of service vulnerabilities and are used less as it harms the services. | |
| exploit | This category of scripts tries to exploit known vulnerabilities for the scanned port. | |
| external | Scripts that use external services for further processing. | |
| fuzzer | This uses scripts to identify vulnerabilities and unexpected packet handling by sending different fields, which can take much time. | |
| intrusive | Intrusive scripts that could negatively affect the target system. | |
| malware | Checks if some malware infects the target system. | |
| safe | Defensive scripts that do not perform intrusive and destructive access. | |
| version | Extension for service detection. | |
| vuln | Identification of specific vulnerabilities. | |
| smtp-commands | discover which SMTP commands are enabled on a mail server | SMTP |
| banner | | |
| http-waf-detect | Detects WAF | WAF |
| http-trace | Sends TRACE request that shows if the method is enabled or not. | |
| smb-os-discovery | discover information about the Operating System and version of a target machine running the SMB (Server Message Block) protocol | SMB |
| http-title | Webserver banner grabbing | |
| sniffer-detect | check whether a system on a local Ethernet has its network card in promiscuous mode. | |
| http-enum | Enumerate common web applications | |
| ntp-monlist | | NTP |
| http-vuln | | NTP |
| sniffer-detect | | |
| dns-brute | Attempts to enumerate DNS hostnames by brute force guessing of common subdomains | DNS |
| broadcast-dns-service-discovery | Attempts to discover hosts' services using the DNS Service Discovery protocol. | DNS |
| dns-zone-transfer | | DNS |
| nbstat | Attempts to retrieve the target's NetBIOS names and MAC address. (-p137) | Netbios |
| snmp-interfaces | | SNMP |
| snmp-netstat | | SNMP |
| snmp-processes | | SNMP |
| snmp-win32-shares | | SNMP |
| snmp-win32-users | | SNMP |
| snmp-win32-software | | SNMP |
| snmp-sysdescr | | |
| smtp-enum-users | | SMTP |
| smtp-ntlm-info | | SMTP |
| smtp-open-relay | | SMTP |
| smtp-vuln-cve2010-4344 | | SMTP |
| smtp-vuln-2011-1720 | | SMTP |
| smtp-vuln-2011-1764 | | SMTP |
| ftp-anon | | FTP |
| ftp-bounce | | FTP |
| ftp-libopie | | FTP |
| ftp-proftpd-backdoor | | FTP |
| ftp-vsftpd-backdoor | | FTP |
| ftp-vuln-cve2010-4221 | | FTP |
| ldap-brute | | LDAP |
| smb-protocols | | SMB |
| broadcast-ms-sql-discover | | |
| ms-sql-brute | | MSSQL |
| ms-sql-config | | MSSQL |
| ms-sql-dac | | MSSQL |
| ms-sql-dump-hashes | | MSSQL |
| ms-sql-empty-password | | MSSQL |
| ms-sql-hasdbaccess | | MSSQL |
| ms-sql-info | | MSSQL |
| ms-sql-ntlm-info | | MSSQL |
| ms-sql-query | | MSSQL |
| ms-sql-tables | | MSSQL |
| ms-sql-xp-cmdshell | | MSSQL |
| rpcap-info | | RPACP |
Run with all scripts
nmap -sC 10.129.200.185 -p 80 --script auth,broadcast,brute,fuzzer,intrusive,version,vuln,malware,exploit,external,dos
nmap -sC 10.129.201.89 -p 8080 --script auth,intrusive,version,vuln,malware,exploit,banner
Wildcard
nmap -p 80 -sV --script=http-vuln* http://www.moviescope.com