1

I scanned my network using nessus and imported the .nessus file to msfdb. Then I executed the vulns command to find vulnerabilities in the imported nessus scan. Is there a command that identifies which vulnerabilities are exploitable?

  • Haven't looked at the details that are available in the .nessus file but the scan reports on the web interface also include a section called "Metasploit module available" or something like that. It include the particular module path as well. Metasploit plugin for Nessus might not be grabbing that ATM but if you can confirm that such info is available in the .nessus/xml file, we will update the plugin to grab these as well. – void_in Sep 17 '16 at 14:41
1

You won't know which are exploitable until you successfully exploit them.

By definition, the vulnerabilities identified are likely to be exploitable, otherwise they would not be identified as vulnerable.

| improve this answer | |
  • But not all vulnerabilities identified will yet have a metasploit module to attempt to exploit them - the question is, "is there a simple method of finding out whether a Nessus flagged vulnerability has a metasploit module to match?" – David Scholefield Nov 16 '16 at 15:23
  • That is a very different question David. – Rory Alsop Nov 16 '16 at 15:24
  • Ah, my apologies then - I'm answering the question I would have asked by the looks of it. Ignore me! – David Scholefield Nov 16 '16 at 15:25
  • to be fair - that probably makes it a better question, and more useful for the OP if they are new to metasploit and unlikely to write their own modules – Rory Alsop Nov 16 '16 at 15:26
  • I agree. And I am not aware of any place to go to find prewritten python modules. – SDsolar Mar 24 '17 at 7:17
1

What would be useful would be a database matching Nessus plugin ID to metasploit modules, but I don't think that exists yet. If there were one I'd be very interested. In the past it has always been a manual search for relevant modules. There may not be a simple cross match though of course as some modules will exploit more than one vulnerability....

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.