Practical Security Automation and Testing

NMAP For web security testing

We will be using the NMAP NSE for the following security testing: security header check, HTTP slow DOS check, SSL cipher check, XSSed history check, SQL injection check, and stored XSS check.

This table lists the NMAP security testing scenario, the NSE script we will need, and the expected results:

NMAP security testing	NMAP NSE script and scan	Expected results
Security header check	nmap -p80 --script http-security-headers <host>	"X-Frame-Options: DENY"
HTTP slow DOS check	nmap -p80,443 --script http-slowloris-check <host>	Should not contain "LIKELY VULNERABLE"
SSL ciphers check	nmap --script=ssl-enum-ciphers <host>	Should not contain "SSL"
XSSed history check	nmap -p80 --script http-xssed.nse ...