The argument --script broadcast tells Nmap to initialize all of the NSE scripts in the broadcast category. This category contains scripts that use broadcast requests, meaning that no probes are sent directly to the targets but to broadcast addresses.
At the moment that this was being written, there were 44 different broadcast scripts available. Let's look at some of the script descriptions, taken from Nmap's official documentation:
- broadcast-avahi-dos: This script attempts to discover hosts in the local network using the DNS service discovery protocol and sends a NULL UDP packet to each host to test if it is vulnerable to the Avahi NULL UDP packet denial of service (CVE-2011-1002).
- broadcast-db2-discover: This script attempts ...
