3.2.1. Vulnerability Scanners: Nessus and OpenVAS
💡 First Principle: Vulnerability scanners work by matching system characteristics (software versions, configurations, service banners) against a database of known vulnerabilities — their accuracy depends on the quality of that database and whether they have authenticated access to check what's actually installed.
Nessus (Tenable) is the most widely deployed commercial vulnerability scanner. Core concepts:
- Plugins — Individual checks, each testing for a specific vulnerability or configuration issue. Nessus has over 180,000 plugins updated continuously as new CVEs are published.
- Policies — Scan templates defining which plugins to run, scan intensity, and credential settings
- Scan types — Basic network scan, credentialed patch audit, web application scan, compliance audit, malware scan
- Output — Findings organized by host, severity (Critical/High/Medium/Low/Info), and CVE reference. Each finding includes description, solution, and plugin output showing why the finding was flagged.
OpenVAS (Greenbone) is the open-source equivalent — similar architecture with a community-maintained Network Vulnerability Tests (NVT) feed. Suitable for organizations needing a free scanner; Nessus offers more polished UI and broader plugin coverage.
Reading Scanner Output — Key Fields:
| Field | What to Check | Red Flag |
|---|---|---|
| CVSS Score | Severity indicator — but evaluate in context | Score alone doesn't determine remediation priority |
| CVE Reference | Cross-reference with NVD for full details | "No CVE" means either informational or obscure finding |
| Solution | Vendor's recommended remediation | "Patch to version X.X" vs. "No patch available" changes response |
| Plugin Output | Raw evidence — what the scanner actually found | Verify the finding is real, not a version-based FP |
| Exploit Available? | Is a public exploit already in Metasploit/ExploitDB? | Yes = dramatically higher priority |
| CVSS Vector | Attack vector (Network/Adjacent/Local), complexity | Network-vectored = remotely exploitable = highest priority |
⚠️ Exam Trap: Vulnerability scanners report detected vulnerabilities, not exploitable vulnerabilities. A scanner may flag a vulnerability based on software version alone (version-based detection) even if the specific vulnerable feature is disabled or the system isn't reachable. Validation is required before treating every finding as confirmed.
Reflection Question: Nessus reports a Critical (CVSS 9.8) vulnerability on a Windows server: a remote code execution flaw in a web server component. Upon investigation, you find the web server service is installed but disabled and not running. How does this context change your remediation priority, and what residual risk remains?
