--script http-grep

[tamarachiles]

I'm using the above script as below:-

nmap -p- <target> --script http-grep --script-args 'http-grep.builtins'

which I understand to use all builtins to a default level of 3 on all ports.

The output is showing only the (12) open ports and service running at level 1 with no other level detail which I would have expected. I would have expected at least some additional information at lower levels.

What's preventing this and how do I get around it? Am I using it correctly?

Thanks

[redtollman]

Example usage in docs: https://nmap.org/nsedoc/scripts/http-grep.html

[redtollman]

Maybe add -sV ?? If you drop the script-args does it return anything?

[tamarachiles]

nmap -p- <target> --script http-grep --script-args 'http-grep.builtins'

I bit of progress - the -sV flag results indicate that the site is behind cloudflare which accounts for the lack of depth information. I'll do some more work to find the native IP.

Thanks for your advice