How do you invoke NSE scripts from the command line and run a category like http-*?

• A. Use --script http-* alone or with --script-args to pass parameters.
• B. Use --script http-* or --script 'http-*'; you can combine with --script-args.
• C. Use -sC to run script categories; you cannot specify http-.
• D. Use --scripts http-*; you can combine with -oX.

Answer: (B)

Invoking NSE scripts from the command line is done with the --script option, and you can target a category by supplying a pattern like http-. This pattern tells Nmap to load all scripts whose names start with http-, giving you a broad set of related tests in one go. Using quotes around the pattern (for example, --script 'http-') helps prevent the shell from expanding the asterisk before Nmap sees it, ensuring the script engine handles the matching as intended. If you need to customize behavior, you can add parameters with --script-args, passing key=value pairs to the scripts.

This approach is preferable to using general discovery flags like -sC, which runs a default, non-filtered set of scripts and doesn’t target a specific category. The option shown uses the correct --script form rather than a plural --scripts variant, which isn’t the standard way to invoke NSE scripts.