Vulnerability Assessment with Nessus: A Hands-On Security Analysis Using Kali Linux and Metasploitable 2

Vulnerability Assessment with Nessus: A Hands-On Lab Using Kali Linux and Metasploitable 2

Identifying security weaknesses, understanding vulnerability severity, and analyzing real scan results in a controlled laboratory environment.

1. Introduction

In cybersecurity, one of the most important questions is: How can we identify security weaknesses before an attacker takes advantage of them?

Every system connected to a network can potentially contain vulnerabilities. These weaknesses may result from outdated software, insecure configurations, weak passwords, or unnecessary services running in the background.

For an organization managing hundreds of computers and servers, manually checking every system for vulnerabilities would be time-consuming and difficult.

This is where vulnerability assessment tools become useful.

In this article, I will explore Nessus, a vulnerability scanner developed by Tenable. I will explain its purpose, how it works, and its advantages and limitations.

I will also demonstrate a vulnerability assessment that I performed using Nessus Essentials on Kali Linux, targeting a deliberately vulnerable Metasploitable 2 virtual machine.

Rather than focusing only on vulnerability scores, I will examine three critical findings and explain the technical evidence provided by Nessus.

2. What Is Nessus?

Nessus is a vulnerability assessment tool. It is designed to identify known vulnerabilities, insecure configurations, outdated software, and other security weaknesses across systems and networks.

Security professionals use Nessus to evaluate the security posture of their infrastructure and determine which weaknesses require attention.

Nessus uses a plugin-based scanning architecture.

Plugins are individual security checks that allow Nessus to detect specific vulnerabilities or collect information about a target system.

For example, a plugin might check whether a server is running an outdated version of Apache Tomcat, whether a network service accepts weak credentials, or whether an insecure protocol is enabled.

Nessus findings may contain:

• Plugin ID and vulnerability description
• CVE identifiers
• CVSS severity scores
• Technical evidence (Plugin Output)
• Affected services and ports
• Recommended remediation steps

One important distinction is that vulnerability assessment is not the same as penetration testing.

A vulnerability scanner identifies potential security weaknesses and may actively validate some findings. A penetration test goes further by investigating whether vulnerabilities can be exploited and how they could affect the overall security of a system.

Nessus is therefore a valuable part of a security assessment, but it does not replace manual security analysis.

3. Why Is Vulnerability Assessment Important?

Imagine a company operating multiple web applications, databases, and internal servers.

Some servers may use outdated software. Others might expose services that are no longer needed. A few systems may still have default credentials configured.

Even if the organization uses firewalls and antivirus software, these weaknesses can create opportunities for attackers.

Vulnerability assessment helps organizations identify such problems before they lead to security incidents.

The main goals are to:

• Detect known security vulnerabilities.
• Identify insecure services and configurations.
• Discover systems running unsupported software.
• Prioritize security issues based on their potential impact.
• Provide information that supports remediation
• Track security improvements through repeated assessments.

However, vulnerability assessment is not simply about finding as many vulnerabilities as possible.

The real value comes from understanding which vulnerabilities matter and determining how they should be addressed.

4. How Does Nessus Work?

Nessus performs vulnerability assessments through several scanning and analysis operations.

Host Discovery

Nessus first attempts to identify reachable systems within the specified target scope.

Port and Service Detection

After discovering a target, Nessus examines accessible network ports and identifies the services running on them.

For example, SSH commonly uses port 22, HTTP uses port 80, and HTTPS uses port 443.

An open port does not automatically indicate a vulnerability. However, identifying services helps determine which security checks should be performed.

Vulnerability Detection

Nessus uses its plugin database to examine discovered services and configurations for known security weaknesses.

Some plugins rely on software versions or configuration information, while others perform active checks to validate vulnerabilities.

Risk Assessment

Nessus can use several metrics to help analysts understand and prioritize findings.

CVSS (Common Vulnerability Scoring System) measures the technical severity of vulnerabilities.

CVE (Common Vulnerabilities and Exposures) provides standardized identifiers for publicly documented vulnerabilities.

EPSS (Exploit Prediction Scoring System) estimates the probability that a vulnerability will be exploited in the wild within the next 30 days.

VPR (Vulnerability Priority Rating) is Tenable’s vulnerability prioritization score, which incorporates information about vulnerability characteristics and threats.

These metrics provide different perspectives. A critical CVSS score does not necessarily mean that a vulnerability is the most urgent issue in every environment.

Results and Remediation

Once a scan is completed, Nessus presents the findings along with technical descriptions, risk information, and possible solutions.

The analyst must then interpret the results and determine which actions are appropriate.

5. Advantages and Disadvantages of Nessus

Like any security tool, Nessus has both strengths and limitations.

Advantages

Automated Vulnerability Detection

Nessus reduces the manual effort required to identify known vulnerabilities across networked systems.

Extensive Plugin Database

Its plugin-based architecture supports vulnerability checks for many operating systems, applications, and network services.

Detailed Technical Findings

Nessus provides information such as vulnerability descriptions, severity scores, affected ports, and remediation recommendations.

Easy-to-Use Interface

Its web interface makes it relatively straightforward to configure scans, review findings, and investigate individual vulnerabilities.

Active Vulnerability Validation

Certain plugins can perform checks that go beyond software version detection. As demonstrated later in this article, Nessus can sometimes verify vulnerable behavior directly.

Disadvantages

False Positives and False Negatives

Not every reported vulnerability is necessarily exploitable, and automated scanners may fail to identify some weaknesses.

Performance Impact

Depending on scan configuration and target sensitivity, vulnerability scanning can place additional load on systems and network services.

Limited Visibility Without Credentials

Unauthenticated scanning cannot provide the same level of internal system information as properly configured credentialed assessments.

Free Version Limitations

Nessus Essentials includes restrictions compared with paid editions.

During my lab, I discovered that the free Essentials edition did not allow me to generate HTML or PDF scan reports.

Therefore, I documented the results using screenshots and the technical evidence displayed in the Nessus interface.

6. Practical Demonstration: Setting Up the Lab

To understand how Nessus works in practice, I created a virtual laboratory using VMware Workstation.

The environment consisted of two virtual machines.

ComponentConfigurationScannerNessus EssentialsScanner OSKali Linux 2026.1TargetMetasploitable 2VirtualizationVMware WorkstationNetworkHost-onlyTarget IP192.168.65.130Scan TemplateBasic Network Scan

Metasploitable 2 is an intentionally vulnerable Linux virtual machine developed for security testing and education.

Because the target contains deliberately insecure services, I configured it to use an isolated VMware Host-only network.

This allowed Kali Linux and Metasploitable 2 to communicate without directly exposing the vulnerable target to the external network.

Step 1: Installing Nessus on Kali Linux

First, I downloaded the appropriate Debian-compatible Nessus installation package from Tenable’s official website.

After downloading the .deb package, I installed it using:

sudo dpkg -i Nessus*.deb

I then started the Nessus service:

sudo systemctl start nessusd

To verify that the service was running, I used:

sudo systemctl status nessusd

After confirming the service status, I opened the Nessus web interface in Firefox:

https://localhost:8834

I completed the Nessus Essentials activation and waited for the plugins to finish compiling.

Figure 1 — Nessus Essentials web interface after installation and initial configuration.

Step 2: Preparing Metasploitable 2

Next, I imported Metasploitable 2 into VMware Workstation.

I configured the target machine’s network adapter to use Host-only networking and connected Kali Linux to the same isolated virtual network.

Get Yunusemreerten’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

After starting Metasploitable 2, I checked its assigned IP address using:

ifconfig

The target machine was assigned:

192.168.65.130

From Kali Linux, I verified connectivity using:

ping -c 4 192.168.65.130

The target responded successfully, confirming that the scanner could reach it.

Step 3: Configuring the Nessus Scan

After completing the network configuration, I returned to the Nessus web interface and selected:

New Scan → Basic Network Scan

I configured the following scan parameters:

Name:
Metasploitable2-Vulnerability-Assessment

Description:
Vulnerability assessment of Metasploitable 2
in an isolated VMware lab.
Target:
192.168.65.130

I used the default Basic Network Scan configuration without providing host credentials.

Figure 2 — Configuring a Basic Network Scan against Metasploitable 2

After saving the configuration, I launched the scan.

7. Analyzing the Scan Results

The vulnerability assessment took approximately 31 minutes to complete.

Nessus displayed 65 entries in the Vulnerabilities section for the single target system.

These entries included security findings, grouped issues, and informational results. Therefore, the number should not be interpreted as 65 independently confirmed exploitable vulnerabilities.

Figure 3 — Completed Nessus scan showing 65 vulnerability-list entries

The scan identified several serious security weaknesses, including:

FindingReported severityUnsupported Ubuntu Linux 8.04CriticalVNC Server Weak PasswordCriticalApache Tomcat GhostcatCriticalSSLv2/SSLv3 Protocol DetectionCriticalBind Shell BackdoorCriticalSamba Badlock VulnerabilityHighWorld-Readable NFS SharesHigh

Instead of discussing every result, I selected three findings that demonstrated different types of security weaknesses.

These were Ghostcat, a weak VNC password, and an unauthenticated bind shell.

Finding 1: Apache Tomcat Ghostcat (CVE-2020–1938)

The first vulnerability I investigated was Apache Tomcat AJP Connector Request Injection, commonly known as Ghostcat.

Nessus identified this issue using Plugin ID 134862.

AttributeResultPlugin ID134862CVECVE-2020–1938CVSS v3.09.8SeverityCriticalVPR7.9EPSS0.9927

Ghostcat affects the Apache JServ Protocol (AJP), which is used for communication between web servers and Apache Tomcat.

When the AJP connector is improperly exposed, an attacker may be able to retrieve protected application files.

Under additional conditions, the vulnerability can also contribute to remote code execution.

What made this finding particularly interesting was the evidence provided by Nessus.

The Plugin Output showed that Nessus sent a crafted AJP request referencing:

/WEB-INF/web.xml

The server returned XML content associated with the protected application configuration file.

The response began with an XML declaration and Apache Software Foundation license information.

This demonstrated that the scanner could retrieve content from a file that should not normally be accessible through an unauthenticated remote request.

Figure 4 — Plugin output from Nessus Plugin 134862 showing evidence of unauthorized file disclosure through the Apache Tomcat Ghostcat vulnerability.

The result provided evidence of unauthorized file disclosure.

Although Ghostcat can lead to more serious consequences under certain circumstances, this particular output did not demonstrate remote code execution.

Remediation: Restrict or disable unnecessary AJP access, require appropriate connector protections, and upgrade Apache Tomcat to a supported, patched version.

Finding 2: VNC Server Weak Password

The second finding involved the VNC service running on TCP port 5900.

VNC (Virtual Network Computing) allows users to access and interact with a remote graphical desktop.

While useful for administration, weak authentication can expose remote desktop sessions to unauthorized access.

Nessus detected the weakness using Plugin ID 61708.

AttributeResultPlugin ID61708Port5900/TCPCVSS v210.0SeverityCriticalAuthenticationWeak password

The most important evidence appeared in the Plugin Output:

Nessus logged in using a password of "password".

This confirmed that the scanner successfully authenticated to the VNC service using a weak password.

Figure 5 — Nessus Plugin 61708 confirming successful VNC authentication with a weak password

Unlike a potential issue detected only from service version information, this result was supported by an actual authentication check.

An unauthorized user who successfully accesses a VNC session could potentially view sensitive information or interact with the remote desktop, depending on session permissions.

Remediation: Use strong, unique passwords, restrict VNC access to trusted networks, and protect remote access through appropriate mechanisms such as VPNs or SSH tunnels.

This finding demonstrated that security risks are not always caused by complex software vulnerabilities. Sometimes, a simple configuration mistake creates a serious exposure.

Finding 3: Bind Shell Backdoor Detection

The third finding was particularly serious.

Nessus detected an unauthenticated bind shell listening on TCP port 1524.

A bind shell is a service that listens for incoming connections and provides command-line access to a system.

If such a service is accessible without authentication, a remote user may be able to execute operating system commands.

Nessus identified the issue using Plugin ID 51988.

AttributeResultPlugin ID51988Port1524/TCPCVSS v3.09.8SeverityCriticalAuthenticationNot requiredObserved privilegesroot

The Plugin Output stated that Nessus successfully executed the id command.

The server returned:

uid=0(root) gid=0(root) groups=0(root)

This output confirmed that the command executed with root privileges.

In Linux, the root account has the highest administrative privileges. Therefore, the ability to execute commands as root without authentication represents a critical security exposure.

Figure 6 — Nessus Plugin 51988 confirming root-level command execution through TCP port 1524

This was the strongest example of active vulnerability validation in my assessment.

The scanner did not merely identify a suspicious service. It demonstrated that an operating system command could be executed through the exposed shell.

Remediation: In a production environment, such a finding should trigger immediate investigation and containment. Administrators should determine whether the system has been compromised and consider rebuilding it from a trusted source.

Because Metasploitable 2 is intentionally vulnerable, this service was expected in the laboratory environment.

8. Comparing the Three Critical Findings

The three findings demonstrated different security problems.

FindingWeaknessObserved evidenceGhostcatImproper AJP accessProtected XML file content retrievedVNC Weak PasswordWeak authenticationSuccessful login using passwordBind ShellUnauthenticated shell accessid executed with root privileges

What I found most useful was the difference between identifying a vulnerability and understanding its actual impact.

Ghostcat demonstrated file disclosure.

The VNC finding demonstrated successful authentication with a weak password.

The bind shell finding demonstrated remote command execution with root privileges.

These results show why security analysts should examine Plugin Output, rather than relying only on vulnerability names and severity scores.

9. Limitations of the Assessment

Although the scan identified several critical security weaknesses, there are some important limitations.

First, I performed an unauthenticated network scan. As a result, Nessus did not have the same internal visibility that credentialed scanning could provide.

Second, Metasploitable 2 is deliberately vulnerable and does not represent a normally maintained production system.

Third, automated vulnerability findings must be interpreted carefully. Some checks demonstrate vulnerable behavior directly, while others rely on version information or indirect evidence.

Finally, the free Nessus Essentials edition did not provide the HTML or PDF reporting functionality I initially expected.

For this reason, I used screenshots and individual plugin outputs to document the assessment.

These limitations are worth considering when using automated vulnerability scanners in real security operations.

10. Conclusion

In this lab, I installed Nessus Essentials on Kali Linux, configured an isolated VMware environment, and performed a vulnerability assessment against Metasploitable 2.

The scan completed in approximately 31 minutes and displayed 65 vulnerability-list entries, including critical security findings and informational results.

I investigated three significant weaknesses: Apache Tomcat Ghostcat, weak VNC authentication, and an unauthenticated bind shell.

The most important lesson from this experiment was that finding a vulnerability is only the first step.

Understanding the technical evidence, evaluating its impact, and identifying an appropriate remediation strategy are essential parts of vulnerability management.

Nessus proved useful for automated discovery, vulnerability identification, and technical validation. However, its findings still require careful analysis, and automated scanning should not be considered a replacement for comprehensive penetration testing.

Overall, this exercise helped me better understand how vulnerability assessment tools operate and how security findings can be translated into meaningful risk information.

References

1. Tenable — Nessus Documentation
2. Tenable — Basic Network Scan Templates
3. Tenable — Nessus Plugins
4. Rapid7 — Metasploitable 2 Documentation
5. Apache Tomcat — Security Advisories
6. NIST — National Vulnerability Database
7. FIRST — Common Vulnerability Scoring System
8. FIRST — Exploit Prediction Scoring System

This assessment was performed exclusively in an isolated, authorized laboratory environment using a deliberately vulnerable virtual machine. All findings and examples are presented for educational purposes.