Nessus Basic Understanding :
Installation and setting up Nessus
In this section, we are going to learn how to use Nessus Essentials, a free version of the enterprise-grade vulnerability scanning platform, Nessus. Please remember you may only use this version for personal projects at home, and using it in a business environment is a breach of Tenable’s licensing. This tool is great to use during certification exams (if it’s permitted! Check before using it), and performing vulnerability discovery on platforms such as HackTheBox.
Nessus Installation
We recommend you complete the next steps whilst in a Kali Linux VM. Visit https://www.tenable.com/products/nessus/nessus-essentials and register for an activation code. Once you’re taken to the next page, on the right-hand side you’ll see this box, where you can download Nessus:
If you can’t find that box, then visit https://www.tenable.com/downloads/nessus and download the right version for your host system — it should be Nessus-X.X.X-debian6_amd64.deb (just CTRL+F and search for “Kali”).
In a terminal, navigate to the directory you downloaded the file to (Most likely /root/Downloads or /(UsernameHere)/Downloads) and use the following command to install Nessus from the .deb file:
sudo dpkg -i <Nessus .deb file name> (run as super user) (Debian package tool) (install) (Nessus package)
Next you’ll need to run the Nessus service (also referred to as the Nessus Daemon), which starts everything up. Use the command service nessusd start, and after a few seconds, go to your browser, and visit https://kali:8834/ — this is the local web GUI for Nessus. Can’t find the webpage? the “kali” section of the URL is your hostname (the part that appears in the terminal after “root@”).
If you’ve previously used Nessus, you may get an error stating you have a corrupt database. To fix this, you need to kill the service using service nessud stop, remove all Nessus files, download the latest version, and install it again. To delete all files for a clean re-install, use the following command in the terminal: rm -rf /opt/nessus (recursively remove everything in the Nessus directory, opt/nessus)
Once you get to the site, you should now be asked what product you want to use, select Nessus Essentials. You can either register here, or if you did it earlier, skip this step to submit your activation code which should’ve been emailed to you. Finally, you’ll be asked to create a username and password to access Nessus locally within your VM. This form should inherit you Kali account details (in my case, ‘root’ and ‘toor’) however you are able to change them to anything you wish.
Now Nessus will download plugins and other crucial files that it needs to function properly, so let it complete (this may take a LONG time, so get up, move around, and come back to it). Once that’s done, you’ll be presented with the Nessus dashboard. From here we can launch scans, create policies, review plugins, and more. For the scope of this module, we will only be looking briefly at plugins, and focusing on using a premade scan template. We strongly encourage you to explore Nessus, as it is widely used in industry and hands-on experience is a great thing to have.
Nessus GUI Walkthrough
On the left-hand side we have a navigation menu, the following sections are interesting to us:
Get Anubhav’s stories in your inbox
Join Medium for free to get updates from this writer.
My Scans — Any scans that have been conducted by the currently signed-in user. This includes completed, scheduled, pending, and failed scans.
All Scans — Any scans that have been conducted by any users within an organisation. This includes completed, scheduled, pending, and failed scans.
Trash — Once you’ve got a scan template, you can send it to the Trash, so that it is no longer in the “My Scans” or “All Scans” tabs.
Policies — Scans are conducted using a target and a policy, which is a list of settings and plugins that you use. Different plugins will identify and test different things.
Plugin Rules — Plugins are the part of Nessus that actually conduct the scanning and enumeration. Using different ones will provide different results, so this is where you can fine tune the scan to look for specific security issues.
Scanners — Scanners are different hosts that are able to perform enumeration. This is useful if there are multiple V-LANs or physical networks that need to be scanned, and the hosts can’t communicate directly. In our case, we only have one, the local scanner running in our VM.
Scanning With Nessus
Next we’re going to perform a simple scan of own our machine to demonstrate how scans work, and what the results look like. You can use the following steps to scan any other hosts on your network (provided you have permission to do so).
- Head over to the Policies tab on the left, and click “Scan Templates” in the description text.
We will now be able to choose from a list of pre-defined templates that can be used for specific actions, such as vulnerability scanning, and host discovery. We will be using the Basic Network Scan for this example.
After clicking on our scan template, we’ll be able to customize the settings for this specific scan. Take a look at all of the settings you can change, as well as the Credentials tab, and Plugins tab. What are the credentials used for? They allow the scanner to log into the system, and collect much more valuable information, as opposed to being locked out and only being able to collect surface information.
For this example, you can name the scan anything you like, and we want to enter the localhost (127.0.0.1) as the target.Click Save in the bottom left-hand corner, and you’ll be taken to the “My Scans” page. From here, we can launch our scan by pressing on the play icon to the right. Once clicked, the scan will get to work. Once it’s finished, a tick will appear, and we’ll be able to take a look at the results.
This is the results pane and provides us with all of the information the scan collected. On the left we have a list of hosts scanned, along with a summary of any vulnerabilities discovered. This would be full of different hosts if we were scanning an entire network and is arranged by criticality of vulnerability by default. On the right we have the Scan Details, and below it we have a donut chart for the security issues identified. Click on the Vulnerabilities tab to see exactly what the scanner identified.
In this example, we don’t expect to see any major vulnerabilities. Here can see there some issues with SSL (this is because of the security exception we had to allow earlier when trying to open Nessus), and some informational issues. You can click on any of these rows in order to get more information and see how to fix them. Click on the SSL issues, then click on the medium-rated SSL issue.
This page shows us a description of the issue, the plugin that was used to detect it, and risk information. Below the description is a solution for how to address the issue. When contacting system owners after a scan, it is good practice to attach an export of the scan as a PDF, but also provide a concise summary in an email with a quick overview of the hosts, any issues, and how to fix them.
This has been a quick learning on how to get Nessus running, and how to launch a scan!
- Which company created Nessus?
Ans: Tenable
2. Under Scan Templates in Nessus, there is a scan for what type of Ransomware?
Ans: WannaCry
3. When creating a new Plugin Rule, what 4 fields do you need to enter?
Ans: Host, Severity, Plugin ID, Expiration Date
4. Is there a scan template specifically designed for mobile devices?
Ans: True
