[Day 12] 4. Nessus

What is Nessus?

Nessus is a vulnerability scanner developed by Tenable, available in multiple editions:

1. Nessus Essentials: Free version for personal, non-commercial use, limited to scanning 16 IPs.
2. Nessus Professional: Full-featured, commercial version for professional environments.
3. Other versions: Nessus Manager and Nessus Cloud for enterprise-level use.

---

Steps to Install and Use Nessus Essentials

1. Download Nessus

1. Go to the official Tenable Nessus download page.
2. Select your platform (Windows in this case) and download the installer.
3. Register for Nessus Essentials by providing your email address. You’ll receive an activation code via email.

---

2. Install Nessus

1. Run the Installer:

   • Double-click the downloaded file to start the installation process.
   • Follow the on-screen instructions to complete the installation.

2. Start the Nessus Service:

   • Once installed, the Nessus service starts automatically. If not, you can start it manually:

     bashCopy
     services.msc
     

     Look for "Tenable Nessus" and start the service.

---

3. Access Nessus on Web Interface

1. Open a web browser and navigate to:

   Copy
   http://localhost:8834
   

   • This opens the Nessus web interface.

2. Set Up an Account:

   • Create an administrator account by providing a username and password.

3. Register Nessus:

   • Select Nessus Essentials during the setup.
   • Enter the activation code you received via email to activate your Nessus installation.

---

4. Configure Nessus

1. Plugin Updates:
   • Nessus will download and update its vulnerability plugins. This may take several minutes, depending on your internet connection.
2. Once the updates are complete, Nessus will be ready to use.

---

5. Perform a Vulnerability Scan

1. Create a New Scan:

   • Log into the Nessus web interface.
   • Click Scans > New Scan.
   • Select the type of scan (e.g., Basic Network Scan).

2. Configure the Scan:

   • Enter the target's IP address or hostname.
   • Provide additional details if required, such as credentials for authenticated scans.

3. Run the Scan:

   • Save the scan configuration and click Start Scan.
   • Nessus will begin scanning the target system for vulnerabilities.

4. Analyze Results:

   • Once the scan completes, Nessus will display the results, including a list of discovered vulnerabilities and their severity levels (Low, Medium, High, Critical).

---

Tips for Effective Use

1. Practice in a Lab Environment: Use Nessus Essentials to scan virtualized environments to avoid accidental scans of unauthorized systems.
2. Explore Report Features: Nessus generates detailed reports, including remediation steps for vulnerabilities.
3. Update Plugins Regularly: Vulnerability definitions evolve rapidly; ensure Nessus is always up to date.

---