Vulnerability Analysis Tools Tutorials
nessus tenable essentials
NOTICE: All the tutorials on this website are meant to help you find security vulnerabilties on your own network and devices to understand your security posture before black hats do. Penetration testing without a written consent is illegal and you can be prosecuted. Use these tutorials to secure your own networks or those whose permission you have been granted. Keep it ethical and keep it professional.
Table of Contents
nessus tenable introduction
Nessus Essentials is a free version of Nessus, a popular vulnerability scanning tool developed by Tenable Network Security. Nessus is widely used by cybersecurity professionals and organizations to identify and assess vulnerabilities in computer systems, networks, and applications. Since this is the free version, it will be able to get you to understand how to use nessus and some of the capabilities it has. You will also see the paid features of the tool at the bottom so you can pay for them if you want those features. While limited and meant for home use only, nessus tenable can still do the following things;
- Vulnerability scanning for known security issues, misconfigurations and weaknesses.
- Host detection and enumeration
- port scanning, banner grabbing and service enumeration
- Identification and classification of vulnerabilities using CVE (Common Vulnerabilities and exposures)
- Generating some basic reports in PDF, HTML and CSV
- Compliance with some standards
Begin by downloading nessus on the official website nessus downloads. Upon completion install it like any other software. It will shift to a web interface and then it will take some time downloading some components. Register for nessus tenable essentials which is the free version of the tool. You will be asked to create your account with a password. Make sure to remember the password you insert here because you will need it everytime you want to access this tool. Submit your information and wait for it to finish the installation.
scanning with nessus
When compilation is done, some default scans might be created for you. I will skip these and go straight to the good stuff. So you can close any window that might open by default. Instead, click on the "New Scan" button on the top right side of the window.
There are many scans available for different types of things so just select one. Some of the scans include;
- Host discovery
- Basicn network scan
- Web Applicaiton Tests
- Credentials patch audit
- Malware scan
- Active Directory starter scan and many more.
For this example I selected the 2022 threat landscape report which scans against the common issues encountered in 2022.
On the window that opens, insert the name, description, and targets. For the targets you can put your local network IP range. Once done, click on the launch button under save. Leave it to complete the scan.
On the "My Scans" menu, you will be able to see the scans that are saved or are running. You can even create a schedule for them. Once a scan is finished, click on it to view the results.
You will see a summarised report, you can click on the vulnerabilities tab and open for each computer. The bottom right side will also summarise the vulnerabilities by CVE. You can rank the results based on the CVE code. You can click on each result and read in more detail for each host.
You can also click on the top right side to generate a report
You can select the format and download the report. In the free version, you can download the summarised report and use it in your local area network to determine the findings. Make sure to select the format for the report on the top of the window.