In my website I have an sql injection vulnerability.
But when I scan my website with Nessus under "Web app tests" there is no result on sql injection.
Why is this? What should I do to make this work?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Nessus is just a tool - it can do things you configure it to, but it is not intelligent in any way.
If you are detecting SQL as an authenticated user, Nessus will not be able to do this unless you allow it to authenticate to your application
If you are detecting it at a specific URL, you need to make sure Nessus is looking at that URL and that it is checking it for SQL.
Many things Nessus misses are down to misconfiguration or permissions, but even once you have set a tool up perfectly, they all have false positives and negatives - which incidentally is why any solely-tool based security scan should not be relied on without manual confirmation!