This is where nmap gets REALLY interesting! It can also run Lua scripts. These can do pretty much anything. Nmap comes with about 600 of them that perform various vuln scanning and enumeration tasks, but you can also code your own.
Location:
<nmap directory>/share/nmap/scripts/*