Skip to main content

Nessus Basics of Vulnerability Scanning

Nessus is one of the most widely used vulnerability scanners in cybersecurity. Developed by Tenable, it helps security professionals and system administrators discover vulnerabilities, misconfigurations, and compliance gaps across systems, networks, and applications.

This guide covers installation, configuration, basic scanning, interpreting results, and best practices for beginners and intermediate users.

warning

Always scan only systems you own or have explicit permission to test. Unauthorized scanning can be illegal and unethical.

  • Extensive vulnerability plugin library updated daily
  • Supports compliance audits and configuration checks
  • Easy-to-use web-based interface
  • Generates detailed, customizable reports
  • Integrates with SIEMs and other security tools for enterprise use

Nessus is ideal for network security assessments, vulnerability management programs, and penetration testing preparation.

Installing Nessus​

Nessus can be installed on Windows, Linux, and macOS, and comes in multiple editions: Nessus Essentials (free), Professional, and Tenable.io (cloud-based).

1. Download Nessus​

2. Install on Linux (Example: Ubuntu/Debian)​

# Download .deb package
sudo dpkg -i Nessus-<version>-debian9_amd64.deb

# Start Nessus service
sudo systemctl start nessusd
sudo systemctl enable nessusd

3. Access Web Interface​

  • Open browser: https://localhost:8834/
  • Create an account and follow registration for plugin updates
tip

Nessus uses SSL; accept the self-signed certificate if prompted.

Basic Workflow in Nessus​

1. Update Plugins​

  • Plugins define the vulnerabilities Nessus can detect
  • Navigate: Settings → Software Update → Check for Updates

2. Create a Target​

  • Go to New Scan → Basic Network Scan

  • Enter:

    • Scan name (e.g., Lab-VM Scan)
    • Target IP addresses or ranges (e.g., 192.168.1.100)
    • Optional: credentials for authenticated scans

3. Configure Scan Options​

  • Port scan: default or specify custom range
  • Scan policy: use default for first scan or create a custom policy
  • Schedule: immediate or recurring scans

4. Launch Scan​

  • Click Save → Launch
  • Monitor progress in My Scans

Understanding Scan Results​

Nessus provides a rich, categorized report:

SeverityDescription
CriticalVulnerabilities that allow remote code execution or full compromise
HighExploitable vulnerabilities with significant impact
MediumVulnerabilities that may expose sensitive information or allow partial compromise
LowMinor weaknesses or misconfigurations
InfoInformational items or best practice recommendations

  • Each finding includes:

    • CVE ID and description
    • Affected host/service
    • Evidence and proof of concept
    • Recommended mitigation or patch instructions

Example:​

  • Vulnerability: CVE-2023-12345 – OpenSSH outdated version
  • Impact: Remote attackers may gain unauthorized access
  • Recommendation: Upgrade OpenSSH to the latest stable version

Common Use Cases​

  • Network vulnerability assessment – Scan IP ranges, routers, servers
  • Web application assessment – Identify misconfigurations, SSL issues, weak ciphers
  • Compliance checks – PCI-DSS, HIPAA, ISO standards verification
  • Patch management – Identify missing patches and updates

Hands-On Labs​

Lab 1: Scan a Local VM​

  1. Set up a lab VM (Windows/Linux)
  2. Add the VM IP as a target
  3. Run a Basic Network Scan
  4. Review and export the vulnerability report

Lab 2: Credentialed Scan​

  • Configure SSH or Windows credentials for the target
  • Run an authenticated scan to detect configuration issues and missing patches

Lab 3: Compliance Scan​

  • Use a pre-defined policy (e.g., CIS Benchmarks)
  • Review compliance report and note deviations\

Best Practices​

  • Only scan authorized systems to avoid legal issues
  • Keep Nessus plugins updated regularly
  • Use credentialed scans for more accurate results
  • Segment scans to avoid overwhelming production networks
  • Combine Nessus reports with manual verification for critical findings