HackBlue

Tools · Nmap and network discovery · 14 / 25

Safe Nmap scripts for a configuration audit: SMB signing, HTTP headers, and SSH algorithms

Use smb2-security-mode, http-title, http-security-headers, and ssh2-enum-algos to answer common hardening questions on hosts you manage.

12 min read · practice only with authorization

Is SMB signing required?

smb2-security-mode reports whether a host’s SMB2 or SMB3 server has message signing enabled and whether it is required. “Message signing enabled but not required” is a common finding, because unsigned SMB sessions can be relayed by an attacker who intercepts authentication. Domain controllers require signing by default; many member servers and workstations historically did not.

The fix lives in Group Policy: “Microsoft network server: Digitally sign communications (always)”. Recent Windows 11 and Windows Server 2025 builds require signing by default, which makes the scan a good way to find older systems.

Snippet
sudo nmap -p 445 --script smb2-security-mode 192.168.56.0/24

What do web servers say about themselves?

http-title prints the page title and is the quickest way to label dozens of web ports: printer admin pages, default “It works!” pages, forgotten Jenkins dashboards. http-security-headers lists headers such as Strict-Transport-Security, Content-Security-Policy, and X-Content-Type-Options. http-server-header shows the Server header even when -sV could not match it.

None of these send attacks. They make normal requests and read the response, which is why they suit inventory work.

Snippet
sudo nmap -p 80,443,8080,8443 --script http-title,http-server-header,http-security-headers 192.168.56.0/24

Which SSH algorithms are offered?

ssh2-enum-algos lists the key exchange, host key, cipher, and MAC algorithms an SSH server offers. Look for legacy entries such as diffie-hellman-group1-sha1, ssh-rsa with SHA-1 signatures, CBC-mode ciphers, or hmac-md5. Modern OpenSSH disables most of these, so finding them points to an old build or a deliberately weakened configuration.

ssh-hostkey prints host key fingerprints. Recording those lets you detect a host whose key changed unexpectedly between scans.

Snippet
sudo nmap -p 22 --script ssh2-enum-algos,ssh-hostkey 192.168.56.101

Lab: one audit pass, one finding each

Point the three groups of scripts at your lab. On a Windows Server VM, leave SMB signing at its default and note the result. On a Linux VM, add an old cipher like aes128-cbc to sshd_config, reload sshd, and confirm the script lists it. On a web VM, serve a page without security headers.

Then fix each: require SMB signing through local security policy, remove the CBC cipher, and add an HSTS header. Rescan and save both outputs. A before-and-after pair is the most persuasive evidence in a hardening report.

Diagram

An audit pass with three script groups

  1. SMB

    Check signing on every 445 listener.

    Command
    nmap -p445 --script smb2-security-mode TARGETS
  2. HTTP

    Label web ports and list missing security headers.

  3. SSH

    List offered algorithms and record host keys.

  4. Fix and rescan

    Change one setting per finding and save the before-and-after output.

Check yourself

1. smb2-security-mode reports “Message signing enabled but not required”. Why does it matter?

2. Which script quickly labels many unknown web ports by page content?

3. What should you look for in ssh2-enum-algos output?