Performing Vulnerability Scanning With Nessus

---
name: performing-vulnerability-scanning-with-nessus
description: Use when performing authenticated and unauthenticated vulnerability scanning
  using Tenable Nessus to identify known vulnerabilities, misconfigurations, default
  credentials, and missing patches across network infrastructure, servers, and applications.
  The scanner correlates findings with CVE databases and CVSS scores to produce prioritized
  remediation guidance. Activates for requests involving vulnerability scanning, Nessus
  assessment, patch compliance checking, or automated vulnerability dete...
domain: cybersecurity
tags:
- vulnerability-scanning
- Nessus
- CVE
- patch-management
- Tenable
subdomain: penetration-testing
version: 1.0.0
author: oyi77
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-06
- GV.OV-02
- DE.AE-07
category: cybersecurity
---

# Performing Vulnerability Scanning With Nessus

## Overview

Cybersecurity skill for performing vulnerability scanning with nessus. Follows industry best practices and security standards.

## When to Use
**Trigger phrases:**
- "performing vulnerability scanning with nessus"
- "Performs authenticated and unauthenticated vulnerability scanning using Tenable "


- Conducting initial vulnerability assessment during the reconnaissance phase of a penetration test
- Performing periodic vulnerability scans to maintain compliance with PCI-DSS (requirement 11.2), HIPAA, or SOC 2 standards
- Validating that remediation efforts have successfully addressed previously identified vulnerabilities
- Establishing a baseline of known vulnerabilities before targeted manual exploitation
- Auditing patch compliance and configuration drift across server and workstation fleets

**Do not use** as a substitute for manual penetration testing, against systems without written authorization, or against fragile systems (medical devices, legacy SCADA) where scanning may cause service disruption.


## When NOT to Use

- When you lack proper authorization for testing
- For production systems without change management
- When the task requires legal or compliance expertise beyond technical scope


## Prerequisites

- Tenable Nessus Professional or Nessus Expert with current plugin updates (plugins should be less than 24 hours old)
- Network connectivity to all target hosts on all ports (no firewall restrictions between scanner and targets)
- Administrative credentials for authenticated scanning (domain admin or local admin for Windows, root/sudo for Linux, SNMP community strings for network devices)
- Target IP ranges and hostnames documented in the scope agreement
- Change management approval for scanning during authorized windows

## Workflow

```python
# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}
```

1. **Plan Operations** — Define objectives, scope, and success criteria for vulnerability scanning operations.
2. **Prepare Environment** — Set up tools, access, and data sources required for vulnerability scanning.
3. **Execute Core Workflow** — Use nessus to perform vulnerability scanning operations following established procedures.
4. **Validate Results** — Verify that results meet quality standards and objectives.
5. **Report Findings** — Document results, observations, and recommendations.
6. **Follow Up** — Track remediation actions and verify fixes where applicable.

## Tools

- **nessus** — Primary tool for this skill
- **Analysis Platform** — Data processing and visualization
- **Collaboration Tools** — Team coordination and knowledge sharing


## Process

1. **Reconnaissance** — Gather target information, identify attack surface, enumerate services
1. **Analysis/Exploitation** — Execute the technique, analyze results, document findings
1. **Reporting** — Document IOCs, write findings, provide remediation recommendations

## Verification

- [ ] All vulnerability scanning procedures executed completely and documented
- [ ] Findings validated against multiple data sources
- [ ] False positives identified and filtered
- [ ] Results documented with evidence and timestamps
- [ ] Recommendations provided with risk-based prioritization

## Anti-Rationalization Table

| Rationalization | Reality |
|---|---|
| "We are too small to be targeted" | Automated attacks target everyone. Size does not matter. |
| "Security slows us down" | A breach slows you down 100x more. Build security in from the start. |
| "We will fix it after launch" | Vulnerabilities in production are exploited within hours. Fix before deploy. |