Vulnerability Scanning with Nessus for Penetration Testing

Join the vulnerability scanning with Nessus for penetration testing course, presented by Central InfoSec, and begin your learning journey.

Connect with us on LinkedIn and X to follow central InfoSec for training updates and CTF events, and to engage with professionals in the vulnerability scanning community.

Learn how proper authorization, in writing, governs legal versus illegal vulnerability testing, guided by the Computer Fraud and Abuse Act (18 U.S.C. 1030), the Morris worm case, and state laws.

Set up Metasploitable 2, a vulnerable Ubuntu VM, in VMware or VirtualBox with host-only networking; download and unzip the file, log in as MSF admin, and find IP with ifconfig.

Explore how Tenable Nessus, a comprehensive vulnerability scanning tool, identifies vulnerabilities and misconfigurations across networks, systems, and applications using agentless and agent-based scanning.

Use Nessus for asset discovery and inventory of network devices, identify rogue devices, assess security posture, prioritize vulnerabilities, and support IT asset management and compliance with PCI-DSS, HIPAA, and GDPR.

Download Nessus from the Noble.com website and choose Linux Debian amd64. Navigate to the downloads folder and install Nessus.

Start the nest service with systemctl start nest, then open Nessus in your browser at https://127.0.0.1:8834 and register to view the Nessus login screen.

Log into Nessus and create a new scan from the My Scans dashboard. Explore templates by category—discovery, vulnerability, and compliance—covering host discovery, basic network scans, and PCI audits.

Configure a host discovery scan in the Nessus scan setup page, name it Discovery Scan, add a description, choose a folder, and specify targets.

View Nessus scan results, including the scan summary with vulnerabilities count, template, start and end times, and the vulnerabilities and host tabs for per-host severities and remediations plus history.

The Nessus 19 506 plugin displays information about the scan and shows critical details for every tested host, including scan type, policy name, port scanners, and port ranges.

Nessus scan results show critical findings: a bind shell backdoor, NFS information disclosure, Unix OS, and vnc with a default password; tomcat ajp injection and ssl weaknesses; tls 1.2/1.3 recommended.

Create branded Nessus reports for internal teams or clients in HTML, CSS, CSV, or PDF formats, and select templates and columns to list vulnerabilities by host.