Vulnerability Analysis · Module 05
Nessus
Vulnerability scanner that finds and rates known flaws, missing patches and misconfigurations.
Safe to try on your own machine. Spin up your Kali Linux lab and practice away — on any system you own or have permission to test. That’s exactly how the pros learn.
Definition
Nessus (by Tenable) is a widely used vulnerability scanning platform with a free (Essentials) and commercial (Professional/Expert) edition.
Identify known vulnerabilities, missing patches, misconfigurations, and compliance gaps across hosts and applications.
Vulnerability assessment and compliance auditing in authorized assessments and ongoing risk programs.
Key features
Uses regularly updated plugins covering CVEs and misconfigurations.
Prebuilt templates: Basic Network Scan, Web App Scan, Compliance Audit.
Authenticated scans give deeper, more accurate results.
Detailed reports with CVSS scores, remediation and executive summaries.
Web interface to schedule recurring scans and manage policies.
Important commands & actions
New Scan -> Basic Network ScanRun a general vulnerability sweep of targets.
New Scan -> Credentialed ScanAuthenticated scan using supplied credentials.
Policies -> New PolicyDefine a custom scan policy (ports, plugin families).
Scan -> LaunchStart the configured scan against targets.
Scan -> Export (PDF/CSV/Nessus)Export results for reporting or import.
nessuscli updateUpdate plugin feeds from the CLI on the scanner host.
Practical examples
- Create a new scan from the Basic Network Scan template.
- Set targets, e.g. 192.168.1.0/24.
- Launch the scan and review findings.
Purpose Identifies open services and known vulnerabilities across the subnet.
- Add SSH or Windows admin credentials to the scan policy.
- Launch against the target host.
Purpose Produces deeper findings such as missing OS patches by authenticating.
- Select a compliance template (e.g. CIS Benchmark).
- Run it against the target systems.
Purpose Checks configuration against a baseline, not only known CVEs.
Important points
- False positives: Uncredentialed scans can be noisy; credentialed scans are more accurate.
- Licensing: Essentials is free but limited (IP cap); Professional/Expert remove limits.
- Impact on targets: Some checks are intrusive — coordinate scan windows with owners.
- Plugin freshness: Results are only as current as the plugin feed — keep it updated.
Common use cases
Regular scheduled scanning to track and remediate risk.
Initial vulnerability identification to prioritize manual effort.
Validate against CIS, PCI-DSS or internal baselines.
Confirm that known issues were fixed after patching.
This tool is taught in Module 05
Read the full written notes, with diagrams, defense and detection.