Are you interested in performing a web application vulnerability scan but have no clue where to begin? If so, read this blog article! I’ll teach you how to use one of today’s most powerful and popular vulnerability scanners, Nessus.
What You’ll Learn:
In a rush? Download the PDF
Download a copy of the article in PDF format to download and/or print.
Download the PDF
Download a copy of the article in PDF format to download and/or print.
What is Nessus?
Nessus is a popular vulnerability scanner widely used by security professionals and organizations to identify security vulnerabilities in their networks and systems. It is a powerful tool that can help you assess the security of your network and identify potential vulnerabilities that attackers can exploit.
How does Nessus work?
Nessus uses various techniques to identify network, system, and application vulnerabilities. Here’s a breakdown of how it works:
- Network Discovery
The first step in a Nessus scan is network discovery. Nessus identifies all the hosts on the network and determines their operating systems, open ports, and services running on them. This information is used to determine what types of vulnerabilities might be present on the network.
- Vulnerability Detection
Once Nessus has identified the hosts on the network, it begins looking for vulnerabilities in the target systems. Nessus uses a variety of techniques to detect vulnerabilities, including:
- Port scanning: Nessus probes open ports to determine if any services are running that may have known vulnerabilities.
- Banner grabbing: Nessus collects information about services running on open ports, including the version number and vendor name, to determine if there are any known vulnerabilities associated with those services.
- Active scanning: Nessus sends specific packets to the target system to see how it responds, looking for vulnerabilities in the way it handles those packets.
- Vulnerability Assessment
Once Nessus has identified potential vulnerabilities on the target system, it performs a vulnerability assessment to determine the severity of each vulnerability. Nessus assigns a severity rating to each vulnerability based on its potential impact on the system, and provides detailed information about each vulnerability, including its description, potential impact, and recommendations for remediation.
- Reporting
Finally, Nessus generates a report that summarizes the vulnerabilities found on the target system, along with their severity ratings, and recommendations for remediation. The report can be customized to include a variety of information, including the scope of the scan, the systems scanned, the vulnerabilities found, and the actions taken to remediate the vulnerabilities.
- Network Discovery
The first step in a Nessus scan is network discovery. Nessus identifies all the hosts on the network and determines their operating systems, open ports, and services running on them. This information is used to determine what types of vulnerabilities might be present on the network.
- Vulnerability Detection
Once Nessus has identified the hosts on the network, it begins looking for vulnerabilities in the target systems. Nessus uses a variety of techniques to detect vulnerabilities, including:
- Port scanning: Nessus probes open ports to determine if any services are running that may have known vulnerabilities.
- Banner grabbing: Nessus collects information about services running on open ports, including the version number and vendor name, to determine if there are any known vulnerabilities associated with those services.
- Active scanning: Nessus sends specific packets to the target system to see how it responds, looking for vulnerabilities in the way it handles those packets.
- Vulnerability Assessment
Once Nessus has identified potential vulnerabilities on the target system, it performs a vulnerability assessment to determine the severity of each vulnerability. Nessus assigns a severity rating to each vulnerability based on its potential impact on the system, and provides detailed information about each vulnerability, including its description, potential impact, and recommendations for remediation.
- Reporting
Finally, Nessus generates a report that summarizes the vulnerabilities found on the target system, along with their severity ratings, and recommendations for remediation. The report can be customized to include a variety of information, including the scope of the scan, the systems scanned, the vulnerabilities found, and the actions taken to remediate the vulnerabilities.
Nessus Scanner Tutorial: Performing a Vulnerability Scan
Now that we’ve discussed the basics of Nessus and how to download and install it, it’s time for the fun part! Let’s perform a vulnerability scan, shall we?
1. Internet
- Launch any web browser (in the video tutorial, I use Microsoft Edge.) In the address bar of the browser, type https://localhost:8834/ and press enter.
- The Your Connection Isn’t Private page will appear. Click on Advanced and click Continue to localhost (unsafe.)
2. Log in
- The Nessus login page appears. Type in the username and address you chose during the initial installation/setup phase. Click Sign in.
3. Nessus
- The Nessus dashboard appears; a pop-up box will typically appear upon launch. Close the pop-up box. We don’t need to do anything with that right now.
4. The dashboard
- The Policies window appears. Click on Create a new policy.
5. New policy
- The Policy Templates window appears. This is where you’ll find all different kinds of ready-made scanning templates for you to use. There are templates for a basic scan, advanced scan, malware scan, web application scan, and many more.
- Click on Advanced scan.
6. Configuring scan settings
- The New Policy/Advanced Scan section appears.
- In the settings section, next to the Basic settings tab, we will give our new scan template a name and a description.
- The next settings tab under Basic is Discovery. Turn off the Ping the remote host option from the right pane.
- Under Discovery, click on Port Scanning.
- Click the Verify open TCP ports found by local port enumerators checkbox and leave all the others in their default settings.
7. Configuring more scan settings
- Click on the Advanced settings tab. Underneath Performance Options, set the values of Max number of concurrent TCP sessions per host and Max number of concurrent TCP sessions per scan to Unlimited.
- Now, let’s click the Credentials settings tab. Select Windows from the options available (assuming you’re working with Windows.)
- The Credentials page of a scan or policy allows you to configure which authentication credentials the Nessus scanner should use during the scan. This allows it to perform various checks to improve the accuracy of its results.
8. Save the scan template
- Click Save to save your new scan template. A Policy saved successfully notification pop-up should appear.
9. Access the new scan template
- From the menu bar, click Scans to open the My Scans window.
- Click Create a new scan.
- Click the User Defined tab.
- Locate your newly created scan template.
10. Name and description of the scan
- Under General settings, enter a name for your scan. You can also describe the scan.
- In the Targets field, enter the IP address of the target you’re scanning.
11. Last configuration
- Under the Schedule settings, double-check to ensure the Enabled switch is turned OFF.
12. Launch the scan
- Locate the Save button and move your mouse to select the drop-down icon next to it.
- Click Launch.
Summary and Key Takeaways
And there you have it! That’s how to run a vulnerability scan using Nessus. The scan can take approximately 15 to 20 minutes; click on the scan to open the results. After some time has gone by, you can check on the scan to see if it’s done. Once it’s finished, click on the name of the scan to view the results.
Let’s review what we’ve learned in this tutorial!
What we’ve learned:
- Nessus is a popular vulnerability scanner widely used by security professionals and organizations to identify security vulnerabilities
- Nessus uses a variety of techniques to detect vulnerabilities
- Nessus assigns a severity rating to each vulnerability based on its potential impact on the system
- Nessus generates a report that summarizes the vulnerabilities
- Downloading and installing Nessus
- How to create a scan template
- Performing a vulnerability scan
References:
“Welcome to Nessus 10.5.X.” Welcome to Nessus 10.5.x (Nessus 10.5), https://docs.tenable.com/nessus/Content/GettingStarted.htm.
References:
“Welcome to Nessus 10.5.X.” Welcome to Nessus 10.5.x (Nessus 10.5), https://docs.tenable.com/nessus/Content/GettingStarted.htm.