--- name: performing-vulnerability-scanning-with-nessus description: 'Performs authenticated and unauthenticated vulnerability scanning using Tenable Nessus to identify known vulnerabilities, misconfigurations, default credentials, and missing patches across network infrastructure, servers, and applications. The scanner correlates findings with CVE databases and CVSS scores to produce prioritized remediation guidance. Activates for requests involving vulnerability scanning, Nessus assessment, patch compliance checking, or automated vulnerability detection. ' domain: cybersecurity subdomain: penetration-testing tags: - vulnerability-scanning - Nessus - CVE - patch-management - Tenable version: 1.0.0 author: Krishna Kumar (xalgord) license: Apache-2.0 nist_csf: - ID.RA-01 - ID.RA-06 - GV.OV-02 - DE.AE-07 --- # Performing Vulnerability Scanning with Nessus ## When to Use - Conducting initial vulnerability assessment during the reconnaissance phase of a penetration test - Performing periodic vulnerability scans to maintain compliance with PCI-DSS (requirement 11.2), HIPAA, or SOC 2 standards - Validating that remediation efforts have successfully addressed previously identified vulnerabilities - Establishing a baseline of known vulnerabilities before targeted manual exploitation - Auditing patch compliance and configuration drift across server and workstation fleets **Do not use** as a substitute for manual penetration testing, against systems without written authorization, or against fragile systems (medical devices, legacy SCADA) where scanning may cause service disruption. ## Most Often Missed & How to Confirm - **Authenticated scanning, not just unauthenticated** — the single biggest gap. Unauthenticated scans miss the majority of local vulnerabilities (missing patches, local config). Always supply Windows local-admin/SSH/SNMPv3 creds and verify they actually worked. - **Confirming credentials landed** — check plugin 19506 (Nessus Scan Information) shows `Credentialed checks: yes` per host; an "Authentication Failure" silently downgrades to a near-useless surface scan. This is routinely overlooked. - **Fresh plugins and full port coverage** — plugins older than 24h miss new CVEs; scanning only the top ports misses services. Configure all 65535 TCP + top UDP. - **Manual false-positive validation** — version/banner detection flags backported-patch distros (RHEL/CentOS) as vulnerable. Verify with `rpm -q --changelog`, vendor advisories, or a manual PoC before reporting. - **Risk-based prioritization over raw CVSS** — fold in exploit availability (Metasploit/PoC), internet exposure, and asset criticality; a CVSS 7 on an internet-facing DC can outrank a CVSS 9 on an isolated box. - **How to confirm**: every reported finding should cite the plugin ID + CVE, the authenticated-scan confirmation (19506), and for Critical/High a manual validation note (PoC result, version check, or "confirmed exploitable during testing"). Don't conclude a host is clean until you've confirmed the scan was credentialed; don't pass a Nessus result straight into the report until you've manually ruled out the common backported-patch and version-detection false positives. ## Prerequisites - Tenable Nessus Professional or Nessus Expert with current plugin updates (plugins should be less than 24 hours old) - Network connectivity to all target hosts on all ports (no firewall restrictions between scanner and targets) - Administrative credentials for authenticated scanning (domain admin or local admin for Windows, root/sudo for Linux, SNMP community strings for network devices) - Target IP ranges and hostnames documented in the scope agreement - Change management approval for scanning during authorized windows ## Workflow ### Step 1: Scan Configuration Configure the Nessus scan policy based on engagement requirements: - **Scan type selection**: Choose "Advanced Scan" for full control over plugin families, or "Credentialed Patch Audit" for patch compliance. Avoid "Basic Network Scan" for penetration tests as it uses a limited plugin set. - **Discovery settings**: Configure port scanning to scan all 65,535 TCP ports and top 1,000 UDP ports. Set host discovery to use ARP (local), TCP SYN, and ICMP for maximum coverage. - **Authentication**: Add Windows credentials (domain account with local admin), SSH credentials (key-based preferred over password), SNMP credentials (v3 with authPriv preferred), and database credentials for database-specific checks. - **Plugin configuration**: Enable all plugin families relevant to the target environment. For penetration testing, ensure "Denial of Service" plugins are disabled unless explicitly authorized. Enable CGI scanning for web servers. - **Performance settings**: Set maximum concurrent hosts per scanner (default 30, reduce for sensitive networks), maximum concurrent checks per host (4-5 for production, higher for test environments), and network timeout values appropriate for the target network. ### Step 2: Scan Execution and Monitoring Launch the scan and monitor for issues: - Start the scan during the authorized testing window - Monitor scan progress through the Nessus web interface, checking for hosts timing out, authentication failures, or plugins causing errors - Watch for credential failures indicated by "Authentication Failure" results; these mean the authenticated scan fell back to unauthenticated mode, producing incomplete results - If specific hosts are crashing or becoming unresponsive, pause the scan, exclude those hosts, and report the issue to the client - For large networks (1,000+ hosts), consider splitting scans into smaller subnets to manage load and allow restartability ### Step 3: Results Analysis and Validation Analyze scan results to separate true positives from false positives: - **Sort by severity**: Start with Critical and High findings; these represent the most exploitable and impactful vulnerabilities - **Validate authentication**: Verify that plugin 19506 (Nessus Scan Information) shows "Credentialed checks: yes" for each host. Unauthenticated results miss local vulnerabilities. - **Eliminate informational noise**: Filter out informational findings unless they reveal useful information for manual testing (service banners, SSL certificate details, open ports) - **Cross-reference CVEs**: For each Critical/High finding, verify the CVE in the National Vulnerability Database. Check if the vulnerability has a public exploit (Exploit-DB, Metasploit module). - **False positive identification**: Common false positives include version-based detection where backported patches make the software appear vulnerable (common in RHEL/CentOS). Check `rpm -q --changelog ` on the target to verify. - **Group by remediation**: Organize findings by the action needed to fix them (e.g., "Apply Windows KB5034441" affects 47 hosts) rather than listing each instance individually ### Step 4: Vulnerability Prioritization Rank validated vulnerabilities for remediation using risk-based prioritization: - **CVSS score**: Use the CVSS v3.1 base score as the starting point. Scores 9.0-10.0 are Critical, 7.0-8.9 High, 4.0-6.9 Medium, 0.1-3.9 Low. - **Exploit availability**: Increase priority for vulnerabilities with publicly available exploit code, especially Metasploit modules or weaponized PoCs - **Network exposure**: A critical vulnerability on an internet-facing system is higher priority than the same vulnerability on an isolated internal server - **Asset criticality**: Consider the business value of the affected system. Domain controllers, databases with PII, and payment processing systems warrant higher priority. - **Compensating controls**: Reduce priority if the vulnerability is mitigated by network segmentation, WAF rules, or EDR protections (document the compensating control) ### Step 5: Report Generation Generate a comprehensive vulnerability scan report: - Export the Nessus report in both executive (PDF) and detailed (CSV/HTML) formats - Create a custom report that includes only validated findings with false positives removed - Include a remediation priority matrix mapping each vulnerability to its recommended fix, affected hosts, and timeline - Add context from manual validation (e.g., "This finding was confirmed exploitable during the penetration test") - Include scan metadata: date/time, scanner version, plugin set date, scan policy used, authentication success rate ## Key Concepts | Term | Definition | |------|------------| | **Authenticated Scan** | A vulnerability scan that uses valid credentials to log into target hosts and perform local checks, detecting significantly more vulnerabilities than unauthenticated scanning | | **Plugin** | A Nessus script that checks for a specific vulnerability, misconfiguration, or compliance item; Nessus maintains over 200,000 plugins updated daily | | **CVSS** | Common Vulnerability Scoring System; a standardized framework for rating the severity of vulnerabilities from 0.0 to 10.0 based on exploitability and impact metrics | | **False Positive** | A vulnerability reported by the scanner that does not actually exist on the target, often caused by version-based detection without exploit verification | | **Credentialed Patch Audit** | A scan type focused specifically on identifying missing operating system and application patches by comparing installed versions against known vulnerability databases | | **Plugin Family** | A logical grouping of Nessus plugins by category (e.g., Windows, Ubuntu Local Security Checks, Web Servers, Databases) | ## Tools & Systems - **Nessus Professional**: Commercial vulnerability scanner by Tenable with over 200,000 plugins covering CVEs, misconfigurations, and compliance checks - **Nessus Expert**: Extended version including external attack surface scanning, IaC scanning, and cloud infrastructure assessment - **Tenable.io**: Cloud-hosted vulnerability management platform for enterprise deployments with asset tracking, trend analysis, and prioritization - **OpenVAS (Greenbone)**: Open-source alternative vulnerability scanner with community-maintained vulnerability tests for comparison scanning ## Common Scenarios ### Scenario: Quarterly PCI-DSS Vulnerability Scan for a Retail Company **Context**: A retailer processes credit card payments and must comply with PCI-DSS requirement 11.2, which mandates quarterly internal and external vulnerability scans. The cardholder data environment (CDE) consists of 200 servers across 3 VLANs. All hosts run either Windows Server 2019/2022 or RHEL 8/9. **Approach**: 1. Configure authenticated scan with domain service account for Windows and SSH key for Linux hosts 2. Use the PCI-DSS scan policy template with all relevant plugin families enabled 3. Scan all 200 CDE hosts during the Saturday maintenance window (02:00-06:00) 4. Identify 847 findings: 12 Critical, 34 High, 189 Medium, 612 Low/Informational 5. Validate Critical findings: 3 are false positives (backported patches on RHEL), 9 are confirmed vulnerabilities 6. Group remaining findings by remediation action: 6 require Windows patches, 2 require Apache upgrades, 1 requires TLS configuration hardening 7. Generate PCI-compliant report showing no Critical or High vulnerabilities remain unaddressed (after remediation and rescan) **Pitfalls**: - Running unauthenticated scans and missing the majority of local vulnerabilities, producing an incomplete compliance report - Not updating Nessus plugins before scanning, missing recently published CVEs - Scanning fragile legacy systems without reducing scan intensity, causing crashes or service disruption - Accepting Nessus results at face value without manually validating critical findings for false positives ## Output Format ``` ## Vulnerability Scan Summary - CDE Environment **Scan Date**: 2025-11-15 02:00-05:47 UTC **Scanner**: Nessus Professional 10.8.3 (Plugins: 2025-11-14) **Hosts Scanned**: 200 (198 authenticated, 2 authentication failed) **Scan Policy**: PCI-DSS Internal Scan ### Findings Summary | Severity | Count | Validated | |----------|-------|-----------| | Critical | 12 | 9 (3 FP) | | High | 34 | 31 (3 FP) | | Medium | 189 | 178 | | Low/Info | 612 | N/A | ### Top Critical Findings **1. CVE-2024-21762 - Fortinet FortiOS Out-of-Bounds Write (CVSS 9.8)** - Affected Hosts: fw-cde-01.corp.example.com (10.50.1.1) - Exploit Available: Yes (Metasploit module) - Remediation: Upgrade FortiOS to 7.4.3 or later - Priority: Immediate - internet-facing device protecting CDE **2. CVE-2024-6387 - OpenSSH regreSSHion (CVSS 8.1)** - Affected Hosts: 14 Linux servers (see Appendix A) - Exploit Available: Yes (public PoC) - Remediation: Upgrade OpenSSH to 9.8p1 or later - Priority: Within 7 days - authenticated remote code execution ``` --- Source attribution: xalgord Original project: https://github.com/xalgord/xalgorix/blob/cec44d71b1d998208e1e2091982d0ee2f928041f/internal/tools/skills/data/penetration-testing/performing-vulnerability-scanning-with-nessus/SKILL.md License: Apache-2.0 License information: https://www.apache.org/licenses/LICENSE-2.0 Original upstream instructions; downloaded from Dave AI. ## Upstream license notice Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright 2026 xalgord Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. # Dave AI resource metadata Creator / publisher: xalgord Original project: https://github.com/xalgord/xalgorix/blob/cec44d71b1d998208e1e2091982d0ee2f928041f/internal/tools/skills/data/penetration-testing/performing-vulnerability-scanning-with-nessus/SKILL.md Attribution basis: Source repository record Fields of work: Data & Analytics, Development & Engineering, Legal, Operations Roles: Compliance Officer, Data Analyst, IT Operations, Security Engineer Specialties: Testing Tools: Tenable Nessus Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 7ae26037671ea8d6d47dfb48c55a63a73f904db2afc517b39c0560588771a197