Where Does Nmap Store Scripts and Data Files?
Nmap reads data files from /usr/share/nmap on Linux with ~/.nmap overrides, and a per user folder on Windows.
Last updated
Nmap hunts for its data files in a fixed order: the --datadir flag first, then NMAPDIR, then a per user folder, then the install directory. The first match wins, which lets you shadow single files without touching the install.
The practical upshot is simple. Custom scripts and tweaked service fingerprints belong in the per user folder, where upgrades cannot wipe them. Anything placed there silently overrides the shipped copy, so revisit it after major updates.
Where Nmap stores this, by platform
/usr/share/nmap
Shipped data: nmap-services, nmap-os-db, scripts/*.nse and nselib. Source builds use /usr/local/share/nmap instead. Personal overrides go in ~/.nmap, which Nmap searches before the system directory.
%APPDATA%\nmap
Per user override folder on Windows, searched before the install directory. The shipped files sit beside nmap.exe. Scan output goes wherever your -oA or -oX flags point, since Nmap never picks an output path on its own.
/usr/local/share/nmap
Homebrew style installs land here, with ~/.nmap as the override slot like other Unix builds. Run nmap --script-updatedb after adding scripts so script.db picks them up.
Frequently asked questions
where do i put custom nmap nse scripts
Drop the .nse file into the scripts folder of your per user directory, ~/.nmap/scripts on Unix or %APPDATA%\nmap\scripts on Windows, then run nmap --script-updatedb. The shipped directory works too but updates overwrite it.
where does nmap save scan output by default
Nowhere. Nmap prints to the terminal unless you add -oN, -oX, -oG or -oA with a filename. Pick the path deliberately, since large subnet scans produce large files.
why is nmap using old fingerprints after upgrading
A stale copy in ~/.nmap or NMAPDIR shadows the new shipped files. Nmap searches those first by design. Remove or refresh your overrides and the new fingerprints take effect.
Notice an outdated path? Let us know.