Read a scripting-engine script before you run it

applied · 75 min · Objective 2.3

Task

Use the Nmap scripting engine against a lab host, but first read a script to predict exactly what it sends — because a category selected carelessly takes you outside your authorisation with no decision being made. Objective 2.3 is reconnaissance tools, and reading before running is the professional habit that separates the domain.

Steps

  1. On the lab network you own, build a target running a service the scripting engine has scripts for.
  2. Pick one safe reconnaissance script. Before running it, read its source and write to /tmp/predict.md: what it connects to, what it sends, and whether it is classed safe or intrusive.
  3. Run the script against your lab target, capture traffic during the run, and confirm the wire matches your prediction.
  4. Now identify a script categorised as intrusive or as a denial-of-service check, read it, and record why you would NOT run it on a client without the scope naming it in writing.
  5. Save all output structured, with the exact invocation, so the run is reproducible.

Verify

grep -cE "^(connects|sends|category):" /tmp/predict.md
tshark -r /tmp/nse.pcap -T fields -e ip.dst 2>/dev/null | sort -u | wc -l
grep -ciE "intrusive|dos|would not run|scope must" /tmp/predict.md

The first count must be at least 3 — you predicted the script's behaviour before running it. The second must be non-zero and should match your lab target: the captured traffic confirms the prediction against reality. The third must be non-zero: you identified an intrusive script and recorded the rule that it does not run without written scope permission — which is scope creep by default setting, avoided.

Notes

Reading a script before running it is the same instinct as reading an exploit before running it, and it matters because the scripting engine ranges from banner grabbing to actual exploitation. A category invoked carelessly can authenticate or change state on a target, and authorisation does not stretch to cover things that merely look similar. On an engagement you name scripts explicitly; here the target is your own lab.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.