Nmap Executor

Run Nmap scans with presets, NSE scripts, smart parsing, logging and resiliency mode.

Nmap Executor

AI-generated

Overview

This node executes Nmap scans on specified targets (IP, hostname, or subnet) using various scan modes such as quick scan, full port scan, service/version detection, OS detection, NSE scripts, or custom flags. It supports running Nmap either directly via the system binary or through a Docker container. The node can output results in text, XML, or greppable formats, and optionally parses XML output into JSON with a smart summary. It also supports saving scan results to a local history file for logging and auditing purposes. This node is useful for network administrators and security professionals to automate network scanning and vulnerability detection within workflows.

Use Case Examples

  1. Perform a quick scan on a target IP to identify open ports rapidly.
  2. Run a full port scan on a subnet to discover all active services.
  3. Use NSE scripts to detect vulnerabilities or enumerate web directories on a host.
  4. Run OS detection to identify the operating system of a target machine.

Properties

Name Meaning
Target (IP or Host) The IP address, hostname, or subnet to scan. This is a required input parameter.
Scan Mode Selects the type of Nmap scan to perform, such as quick, full, version detection, OS detection, NSE scripts, or custom flags.
NSE Scripts Specifies which NSE scripts to run when Scan Mode is set to NSE Scripts. Multiple scripts can be selected.
Runner Determines how Nmap is executed: either directly via system binary or through a Docker container.
Docker Image Specifies the Docker image to use when running Nmap via Docker.
Use --net=host Enables host networking mode for Docker, useful for SYN scans or when host network access is needed.
Extra Docker Args Additional optional arguments to pass to the Docker run command.
Custom Nmap Flags Custom flags to pass to Nmap when Scan Mode is set to Custom Flags.
Output Format Specifies the format of the Nmap output: text, XML, or greppable.
Timeout (seconds) Maximum time in seconds to wait for the Nmap scan to complete.
Nmap Path (optional) Path to the Nmap binary if it is not in the system PATH (used only with system binary runner).
Enable Smart Result If enabled, parses XML output into JSON and provides an intelligent summary of the scan results.
Save Scan to History If enabled, saves the scan output and summary to a local JSON log file for history tracking.

Output

JSON

  • error - Indicates if an error occurred during the scan.
  • message - Error message if the scan failed.
  • details - Detailed error information or scan output.
  • target - The scanned target IP or hostname.
  • cmd - The executed Nmap command.
  • output - Raw output from the Nmap scan.
  • format - Output format used (text, xml, grep).
  • flags - Nmap flags used for the scan.
  • parsed - Parsed JSON object of the XML output if smartResult is enabled.
  • summary - Intelligent summary of the scan results including open ports and vulnerabilities.
  • resiliencyTried - Indicates if a retry scan with -Pn flag was attempted due to initial failure.

Dependencies

  • Nmap executable or Docker with instrumentisto/nmap image
  • xml2js library for XML parsing

Troubleshooting

  • Missing target parameter: Ensure the 'Target (IP or Host)' parameter or input field 'target' is provided.
  • Nmap execution failure: Check if Nmap is installed and accessible or Docker is properly configured.
  • Scan failure due to host down or DNS resolution issues: The node retries with -Pn flag automatically in such cases.
  • Timeouts: Increase the timeout parameter if scans take longer than expected.
  • Parsing errors: Enable 'Enable Smart Result' only if output format is XML to avoid parsing issues.

Links

Discussion