Vulnerability Scanning with Nessus: A TryHackMe Walkthrough (Setup to Web App Scanning)

Introduction

Nessus is one of the most widely used vulnerability scanners in the industry, and knowing how to install, configure, and actually read its output is a foundational skill for any SOC analyst or penetration tester. This write-up documents a full walkthrough of TryHackMe’s Nessus room — from connecting to the lab VPN and installing Nessus, through navigating its interface, running a basic network scan, and finally running a dedicated web application scan against a deliberately vulnerable target (DVWA).

Task 1–2: Connecting to the Lab and Installing Nessus

The first step was connecting to the TryHackMe network via the Cloudflare WARP client, then bringing up the OpenVPN tunnel for the room.

Terminal output showing warp-cli registration new and warp-cli connect, followed by connecting to the TryHackMe OpenVPN network for the room.

Disconnecting the WARP client (warp-cli disconnect) once the OpenVPN tunnel is active.

The TryHackMe “Nessus” room page — “Learn how to set up and use Nessus, a popular vulnerability scanner.”

First: download Nessus from Tenable’s site.

The Tenable Nessus download page, selecting the appropriate version and platform (Linux — Debian amd64).

Installing the downloaded .deb package via dpkg, with Nessus running through its integrity/cipher self-checks (all passing) during setup.

Once installed, Nessus is enabled and started as a systemd service:

sudo systemctl enable nessusd
sudo systemctl start nessusd
sudo systemctl status nessusd

systemctl status nessusd confirming the Nessus Vulnerability Scanner service is active and running.

Now open the browser at https://localhost:8834.

The Nessus Essentials login page.

Credentials used:

• User: karim
• Pass: ******

The “Welcome to Nessus Essentials” screen, prompting to run a Host Discovery Scan to identify available hosts on the network, with a target range entered (192.168.1.1-192.168.1.16).

Welcome to Nessus Essentials. To get started, run a Host Discovery Scan to identify the available hosts on your network to scan. Hosts discovered through a Discovery Scan do not count toward the 16-host limit on your license.

Entering targets: targets can be entered as:

• Hostnames
• IPv4 addresses
• IPv6 addresses

For IP addresses, you can use:

• CIDR notation, e.g. 192.168.0.0/24
• A range, e.g. 192.168.0.1-192.168.0.255
• A comma-separated list, e.g. 192.168.0.0, 192.168.0.1

Task 3: Navigation and Scans

The “All Scans” view in Nessus Essentials, listing previously run scans (a Basic Network Scan and a Host Discovery Scan).

Q: What is the name of the button which is used to launch a scan?

The “All Scans” page with the New Scan button (top right) circled — this is the button used to launch a new scan.

Q: What side menu option allows us to create custom templates?

The Policies page, with the “scan templates” reference circled — Policies is where custom scan templates are created.

Q: What menu allows us to change plugin properties such as hiding them or changing their severity?

The Plugin Rules page — used to hide plugins or change their severity, optionally scoped to a specific host or time frame.

Q: In the ‘Scan Templates’ section after clicking ‘New Scan’, what scan allows us to see simply what hosts are alive? Q: Which scan type is considered ‘suitable for any host’? Q: Which scan allows you to ‘Authenticate to hosts and enumerate missing updates’? Q: Which scan is specifically used for scanning Web Applications?

The Scan Templates gallery, annotated with arrows identifying: Host Discovery (see what hosts are alive), Basic Network Scan (suitable for any host), Credentialed Patch Audit (authenticate and enumerate missing updates), and Web Application Tests (scanning web applications).

Task 4: Scanning — Running a Basic Network Scan Against DVWA

Now run the target machine (DVWA) and scan it with Nessus.

The DVWA (Damn Vulnerable Web Application) login page on the deployed target VM.

Q1: Create a new ‘Basic Network Scan’ targeting the deployed VM. What option can we set under ‘BASIC’ to schedule this scan to run at a specific time? (Useful when network congestion is an issue.)

The New Scan / Basic Network Scan settings, under BASIC → Schedule — where the scan’s frequency, start time, and timezone can be configured.

Q: Under ‘DISCOVERY’, set the ‘Scan Type’ to cover ports 1–65535. What is this type called?

The Discovery settings’ Scan Type dropdown, with “Port scan (all ports)” selected/circled.

Q: What ‘Scan Type’ can we change to under ‘ADVANCED’ for a lower-bandwidth connection?

Notes: the Low Bandwidth scan type is good for slow or busy networks because it uses less network traffic and does not put heavy load on the network.

The Advanced settings’ Scan Type dropdown, with “Scan low bandwidth links” selected/circled.

Q: After the scan completes, which ‘Vulnerability’ in the ‘Port scanners’ family lets us view the open ports on this host?

The completed “Scan DVWA” results overview — 1 host, 4 vulnerabilities found.

The Vulnerabilities list for the DVWA scan, with the Nessus SYN scanner finding (Port scanners family) circled — this is where the open ports on the host can be reviewed.

Q: What Apache HTTP Server Version is reported by Nessus?

Plugin #10107 (“HTTP Server Type and Version”) output for the DVWA host, reporting Apache/2.4.41 (Ubuntu).

Task 5: Scanning a Web Application

First, run a new scan using the ‘Web Application Tests’ template against DVWA.

Get Karim roshdy’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Q: What is the plugin ID of the plugin that determines the HTTP server type and version?

This plugin can be found under Vulnerabilities in: HTTP (Web Servers) → HTTP Server Type and Version.

The Web Application Scan results for DVWA, showing Plugin #10107 (“HTTP Server Type and Version”) in the vulnerabilities list.

Q: What authentication page is discovered by the scanner that transmits credentials in cleartext?

This vulnerability can be found under Vulnerabilities: Web Server → Web Server Transmits Cleartext Credentials.

The “Web Server Transmits Cleartext Credentials” finding, showing the destination page /login.php as the page transmitting credentials without encryption.

Q: What is the file extension of the config backup?

Found under Vulnerabilities: Backup Files Disclosure.

The “Backup Files Disclosure” finding, showing the readable backup file /config/config.inc.php.bak.

Q: Which directory contains example documents? (in a PHP directory)

Found under Vulnerabilities: Browsable Web Directories.

The “Browsable Web Directories” finding, listing browsable paths on the target — including /external/phpids/0.6/docs/examples/, which contains example documents.

Q: What vulnerability is this application susceptible to that is associated with X-Frame-Options?

Found under Vulnerabilities: Web Application Potentially Vulnerable to Clickjacking — the remote web server does not set an X-Frame-Options response header (or a Content-Security-Policy frame-ancestors header), which can expose the site to clickjacking / UI redress attacks.

The “Web Application Potentially Vulnerable to Clickjacking” finding and its full description.

Room Completed

The completed TryHackMe “Nessus” room — all five tasks (Introduction, Installation, Navigation and Scans, Scanning!, Scanning a Web Application!) marked complete at 100%.

Conclusion

This walkthrough covered the full Nessus workflow end-to-end: getting the scanner installed and running as a service, understanding the Nessus Essentials interface (Scans, Policies, Plugin Rules), configuring scan-level settings that matter in real environments (scheduling to avoid congestion, full port-range discovery, low-bandwidth scanning for busy networks), and finally reading and interpreting real findings from both a Basic Network Scan and a dedicated Web Application scan against DVWA — from server fingerprinting (Apache version, HTTP server plugin) to concrete web vulnerabilities (cleartext credential transmission, exposed backup files, browsable directories, and missing clickjacking protections).

The progression from “what button do I click” to “what does this specific finding mean and where do I find it” reflects the realistic learning curve of getting comfortable with a vulnerability scanner as a working tool rather than just a button to press.

References & Tools

• TryHackMe — Nessus room: tryhackme.com/room/rpnessusredux
• Tenable Nessus (product page): tenable.com/products/nessus
• DVWA (Damn Vulnerable Web Application) — the intentionally vulnerable target scanned in this walkthrough.

This write-up documents a hands-on TryHackMe lab exercise performed as practical security analyst training, covering Nessus installation, configuration, and vulnerability scanning against a DVWA target.