Tools · Nmap and network discovery · 13 / 25
Nmap NSE script categories explained: default, safe, intrusive, and vuln
What each NSE category means, what -sC actually runs, and how to build a boolean script expression that stays inside an audit’s rules.
Every script carries labels
The Nmap Scripting Engine runs Lua scripts that extend a scan: grab a page title, list TLS ciphers, check SMB signing, and much more. Each script declares one or more categories. The ones you will use most are default, safe, discovery, version, intrusive, vuln, auth, and brute. Others include broadcast, dos, exploit, external, fuzzer, and malware.
Categories describe risk and purpose. Safe scripts are not expected to crash services or consume much bandwidth. Intrusive scripts might. Vuln scripts check for specific known weaknesses. External scripts send data to a third-party service, such as a WHOIS server, which matters if your targets are confidential.
What -sC really runs
-sC is the same as --script=default. The default set is chosen to be fast, useful, reliable, and not intrusive, but “default” is not a synonym for “safe” in every environment. A handful of default scripts open many connections or send unusual requests that older embedded devices handle badly.
You can see exactly which scripts a selector expands to with --script-help. Do that before running a selector you have not used before, especially on equipment you do not own outright.
nmap --script-help default | grep -E "^[a-z0-9-]+quot; | head -40 nmap --script-help "safe and discovery" | grep -c Categories
Lab: write a selector for an audit
Suppose your rules of engagement allow discovery and safe checks but forbid brute forcing, denial of service, and anything that sends data outside the lab. Express that with a boolean selector: "(default or safe or discovery) and not (intrusive or brute or dos or external)". Run it against your lab web server and SSH host.
Compare the script list to a plain -sC. The difference shows why writing the selector explicitly is better than trusting a shortcut: it documents what you agreed to run, and it keeps out categories that were never discussed.
sudo nmap -sV --script "(default or safe or discovery) and not (intrusive or brute or dos or external)" -p 22,80,443 192.168.56.101 -oA audit-nse
Categories to keep out of routine scans
Brute scripts try credentials and can lock accounts. Dos scripts are designed to test whether a service can be knocked over. Exploit scripts attempt to use a vulnerability. Those belong in a separately approved test window, with the owner aware and a rollback plan, not in a weekly inventory scan.
For production inventory, a small, named list of scripts is easier to defend than any category. The next tutorials show a few that answer common audit questions.
Diagram
NSE categories by how careful you need to be
Pick categories that match what the owner approved.
- safe, discovery, version
Low risk. Suitable for routine lab and inventory scans.
- default (-sC)
Curated and mostly low risk. Check the expanded list first.
- vuln, intrusive, auth
Targeted checks. Need explicit approval and a test window.
- brute, dos, exploit
Can lock accounts, crash services, or change state. Separate authorization only.
- external
Sends data to third parties. Consider confidentiality.
Check yourself
1. Which option is equivalent to -sC?
2. Why might the external category matter for a confidential client?
3. Which category should never appear in a routine weekly scan?