Most people use Nmap to find open ports and stop there, but some of the NSE scripts are worth digging into.
One of my favorites is:
nmap --script ssl-cert -p443 <target>
Instead of just confirming HTTPS is running, it pulls information directly from the server's TLS certificate, including:
- Subject
- Issuer
- Subject Alternative Names (SANs)
- Expiration date
- Public key details
It's a quick way to identify virtual hosts, spot certificate issues, or discover additional hostnames during an authorized security assessment.
What's your favorite Nmap script that deserves more attention?
--
wormy
"Check everything"
wormy
"Check everything"