E-NES
Nessus
Automated vulnerability scanner with a huge, daily-updated plugin library covering CVEs, misconfigs, and compliance checks.
OVERVIEW
Nessus (tenable.com/products/nessus) is Tenable's vulnerability scanner: point it at a host or range and its plugin engine — updated daily with checks for newly disclosed CVEs — probes for missing patches, default credentials, and misconfigurations across operating systems, network devices, and common services, then rolls the findings into a scored, prioritized report.
It supports both unauthenticated scans (an external, black-box view of what's exposed) and authenticated scans (credentialed access that reads installed package and patch levels directly, producing far fewer false positives), plus built-in compliance policy checks (CIS benchmarks, PCI DSS) commonly requested alongside a pentest. The free Essentials tier caps scanning at 16 IPs, enough for a home lab or a small proof of concept but not most paid engagements — Professional removes that limit.
USE CASES
Practical use cases
- 01
Running an authenticated scan across a host range to get a prioritized, CVE-mapped list of missing patches.
- 02
Checking a host or subnet against a compliance policy (CIS, PCI DSS) requested alongside the pentest.
- 03
Validating that vulnerabilities flagged in a previous assessment were actually remediated.
- 04
Getting a broad, automated baseline before spending manual testing time on the highest-severity findings.
QUICK START
Once hosts and services are enumerated, to run an authenticated or unauthenticated scan against them and get a prioritized list of known vulnerabilities.
- Confirm the host range and scan type (unauthenticated vs. authenticated) are within the agreed scope.
- Install Nessus and register for an Essentials or Professional activation code.
- Create a new scan, pick a template (Basic Network Scan, or a compliance policy), and set the target range.
- If authenticated scanning is in scope, add the provided credentials to the scan policy.
- Launch the scan, then review and triage the results by severity before reporting.
BEFORE YOU RUN IT
What to check before running it
Scan traffic and plugin probes are distinctive and easily flagged by any IDS/IPS or EDR watching the segment — coordinate timing with the client if stealth matters.
Unauthenticated scans can crash fragile legacy services or IoT/OT devices; get explicit sign-off before scanning anything sensitive without a maintenance window.
A plugin match is a starting point, not a confirmed finding — validate anything critical manually before it goes in the report.