Mastering the Nmap Scripting Engine

Web application auditing data files

NSE is well-known for its web scanning capabilities, and some of the scripts also require data files to increase their flexibility. Again, as a general recommendation, you should go through them to ensure that they apply to your locale. Let's review what data files are available for web security auditing.

http-fingerprints.lua

This is the most important file related to web scanning in NSE. It contains the fingerprints used by the http-enum script. The http-enum script is the web enumeration script that looks for common application paths and forgotten configuration files; it even detects some web vulnerabilities.

The fingerprints are actually Lua tables. An entry looks somewhat similar to the following:

table.insert(fingerprints, ...