Skip to content

Nmap Executor

Category: Network and Vulnerability Scanners Script: nmap.py Integration: CLI Faraday Plugin: NmapPlugin Website: https://nmap.org/

Description

Runs an Nmap network scan against one or more targets with configurable port ranges, scripts, and timing options. Results are output in XML format and parsed by the Faraday Nmap plugin.

Prerequisites

  • Nmap installed and available in $PATH
  • Verify: nmap --version

Configuration

Environment Variables

(none required)

Execution Arguments

Parameter Type Mandatory Description
TARGET list Yes JSON array of target IPs, domains, or CIDR ranges (e.g., ["192.168.1.0/24", "example.com"])
PORT_LIST list No JSON array of ports (e.g., ["80", "443", "8080"])
TOP_PORTS string No Number of top ports to scan (e.g., "100")
OPTION_SC boolean No Enable -sC (default NSE scripts)
OPTION_SV boolean No Enable -sV (service version detection)
OPTION_PN boolean No Enable -Pn (skip host discovery, treat all hosts as online)
SCRIPT_TIMEOUT integer No Timeout for NSE scripts (seconds)
HOST_TIMEOUT integer No Timeout per host (seconds)
SCRIPT_CMD string No Custom --script argument (e.g., "vuln,exploit")

YAML Configuration Example

executors:
  nmap_scan:
    repo_executor: nmap.py
    max_size: 65536
    varenvs: {}
    params:
      TARGET:
        mandatory: true
        type: list
        base: list
      PORT_LIST:
        mandatory: false
        type: list
        base: list
      OPTION_SV:
        mandatory: false
        type: boolean
        base: boolean
      OPTION_SC:
        mandatory: false
        type: boolean
        base: boolean

How It Works

  1. Reads the TARGET list and builds an nmap command line
  2. Appends optional flags (-sC, -sV, -Pn) if enabled
  3. Adds port specifications from PORT_LIST or TOP_PORTS
  4. Runs nmap [options] -oX - -- <targets> (XML output to stdout)
  5. Passes XML output through NmapPlugin to generate Faraday entities

Notes

  • PORT_LIST and TOP_PORTS are mutually exclusive; if both are provided, PORT_LIST takes precedence
  • Targets are passed after -- to prevent them from being interpreted as Nmap options
  • Requires sufficient OS privileges for certain scan types (e.g., SYN scan requires root)