Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [nessus]

Nessus is a vulnerability scanning product and vulnerability management product that has both free 'Home' and paid 'Commercial' editions

1
vote
0answers
47 views

Rationale for removing cronie-anacron

My Nessus scanner reports that I need to remove cronie-anacron. What is the rationale for this? The Nessus output is: 3.3.b(2) Disable Anacron checking that the anacron RPM package is not ...
0
votes
2answers
50 views

How to check if a list of domains contains any WordPress installation?

Does any software or any other way to detect if a website contains any WordPress installation? For example lets say we have the website example.com which is not a WordPress site, but we have a ...
0
votes
2answers
73 views

vulnerability scans on machines not on the network?

Is it possible to scan laptops of users who are not on your network (i.e. consultants) before giving them access to resources? Can you also explain the reasoning behind why/why not? Thank you.
1
vote
0answers
92 views

Router detects my Nessus scan and kicks me off the network [closed]

I'm trying nessus on a public router. When I run a scan on the router at 10.0.0.1, the router somewhat detects it and proceeds to kick me off. If I put targets : 10.0.0.2-10.0.0.255 (scann all ...
2
votes
1answer
704 views

Nessus found a vulnerability, but no corresponding exploit on Metasploit : How to run with meterpreter

I ran Nessus on a local network, it found a critical vulnerability for the router: MikroTik RouterOS < 6.41.3 SMB Buffer Overflow (Vulnerability description : Exploit-db) But I can't find any ...
0
votes
0answers
37 views

Nessus scan over particular forwarded ports with metepreter

During a penetration lab, I have access to a Windows XP machine that allows me to forward ports locally using meterpreter. Example: portfwd add -L 127.0.0.1 -l 8022 -r 10.0.0.125 -p 7022 Can I ...
1
vote
0answers
178 views

Nessus ADV180002: Microsoft SQL Server January 2018 Security Update (Meltdown) (Spectre)

I have a MS Server 2012 r2 running ArcServe 17.5, which uses MSSQL Server Express 2014. When Nessus runs a scan of this system, I am getting the plugin 105613 - ADV180002: Microsoft SQL Server January ...
4
votes
1answer
146 views

Is it possible to invoke OS commands from a NASL script in OpenVAS?

I was wondering if it is possible to run a command like cat, w3m or any other Operating System (Linux) utility from inside a NASL script and use its output. Do you know any examples? I know you can ...
1
vote
3answers
154 views

nikto's results differ from other vulnerability scanners , is it more or less accurate?

I was doing some scanning on a web application, I used OWASP zap and Nessus. The risks that these two detected were medium to low, very few vulnerabilities. Then I tried nikto, and the results were ...
0
votes
1answer
255 views

Nessus keeps detecting mDNS

I’m scanning my Windows 10 machine with my Kali Linux virtual box. I have a medium level vulnerability with mDNS. The solution according to the Nessus docs is to block UDP port 5353 even though the ...
2
votes
2answers
127 views

Nessus for Operational Technologies

I want to scan with Nessus a network which include OT devices but I don't know how can I config Nessus to do it. Firstly, I disable ping scan, before of Nessus scan I do a IP enumerate with Nmap, and ...
2
votes
1answer
249 views

Nessus Target Availability

I need to write a script (I am not asking for script !) in order to verify if target Servers are available (Up or Down) for Nessus scan or not. The problem is that, sometimes even if ping does not ...
0
votes
1answer
303 views

Replace Nmap with Nessus

I have to replace NMAP with Nessus. I got answer for few settings, but there are few settings in NMAP for which I am not able to get answer. If you could answer me, it would be helpful. For example, ...
7
votes
3answers
4k views

Nessus Port scan Vs NMAP Port scan

My objective is to find network vulnerabilities. I have used Nessus and NMAP both for vulnerability scan. I have to verify if I can use only "Nessus" rather than using "NMAP". According to my ...
12
votes
2answers
2k views

Tons of vulnerabilities are found on tcp/0 port using vulnerability scanners

Performed credentialed Vulnerability scan on linux/Unix servers by Nessus and thousand of vulnerability came out of port tcp/0. How could a IANA reserved port(tcp/0) handle traffic? Are those ...
2
votes
1answer
429 views

Nessus scan reports a Dropbear vulnerability on a machine that does not have dropbear installed

Scanning a machine on a local network (it is the only machine scanned, and is running Red Hat Enterprise Linux 7.4) and Nessus reports a vulnerability present in an outdated version of Dropbear SSH ...
0
votes
0answers
382 views

Checking Intermediate Certificates Programatically

Nessus is reporting that an "SSL Certificate Cannot Be Trusted". This is due to the intermediate certificate not being in the certificate bundle presented during the TLS/SSL handshake. I've looked ...
1
vote
0answers
1k views

Credentialed scanning through SSH tunnel

If I wish to run Nessus against a Windows server that is only accessible from another machine, I can setup an SSH tunnel like so: ssh user@10.99.5.6 -L 127.0.0.1:445:10.0.0.45:445 -L 127.0.0.1:139:10....
1
vote
1answer
572 views

Difference between Lynis and Nessus and yet another hardening tool

I am writing an open source python tool aimed at inventoring/auditing and hardening of a system. When I started off with the project, I did some research around it and figured out that there were not ...
2
votes
1answer
832 views

Nessus Default Ports

When scanning with nessus and defining the ports, there is an option where you could simply type "default" and nessus will scan certain ports. I was wondering what the ports were? I am assuming the ...
2
votes
1answer
595 views

CGI Generic Injectable Parameter

In this security scan, the parameter is found to be at risk of cross-site scripting attacks. Does this mean as below under name="target" attackers can replace the value of 'target' ? What sort of risk ...
1
vote
0answers
313 views

Nessus Denial of Service checks

What's the difference between the "Denial of Service" plugin family and other plugins with "DoS" in the Plugin Name but located in different families? Can those other plugins also cause DoSs during ...
0
votes
4answers
533 views

Attack Metasploitable using Nessus

For my computer security class I have to prepare a malicious attack using Tenable Nessus security scanner. The scanner and target, which is Metasploitable2, both have been installed on separate ...
0
votes
1answer
86 views

Security errors with printer

I ran a security scan using the home version of Nessus by following a post on LifeHacker, and I was told that my printer had two security errors: OpenSSL 'ChangeCipherSpec' MiTM Vulnerability SNMP ...
1
vote
1answer
2k views

Can Nessus scanner be used behind a proxy?

Is it possible use Nessus behind a proxy like Burp or OWASP ZAP? I tried to configure it in Web Proxy Settings, but it didn't work. I need to see all request/response that are performed during the ...
1
vote
1answer
274 views

Export Nessus Professional vulnerability scan results listed by vulnerabilities

When I export Nessus Professional vulnerability scan results into HTML, the results are listed by host. Is it possible to export Nessus Professional vulnerability scan results listed by ...
1
vote
2answers
588 views

search for exploits in metasploit

I scanned my network using nessus and imported the .nessus file to msfdb. Then I executed the vulns command to find vulnerabilities in the imported nessus scan. Is there a command that identifies ...
1
vote
1answer
162 views

Nessus Vulnerability Scanner

My question is: can we use Nessus to perform a scan on a remote server? Or is it used only to perform scans on the local network?
1
vote
2answers
688 views

How to specify virtual web hosts in Nessus (host header/SNI)

Say I have the web server 198.51.100.125 in Amazon cloud that I want to scan, which is hosting two domains example.com and example.org. In Nessus, I have configured the targets like so: 198.51.100....
3
votes
1answer
2k views

Nessus: Host Discovery Scan finds no host

I am just starting my studies on pentesting and I have created a lab with Virtual Box with two VM's: a Kali-Linux machine and a Metasploitable2 machine. Their networks are both configured to be ...
4
votes
2answers
616 views

How to test CVE-2004-0789 Multiple Vendor DNS Response Flooding Denial Of Service?

I use Nessus to check vulnerabilities on my webserver. It is a Windows Server. Nessus reports that this particular server has a CVE-2004-0789 vulnerability. Here is the description from Nessus: The ...
0
votes
2answers
391 views

Is Nessus approved for PCI Scans?

Question is in the title. I can't seem to find a straight answer and Tenable seem to be dodging a yes/no answer on their website. I was told a few years ago that Qualys was approved by PCI for PCI ...
1
vote
0answers
411 views

Nessus 6.7.0 global.db file growing exponentially

We upgraded from Nessus 5.x to 6.7. Our old global.db file was only ~300kb consistently before the upgrade. Since we upgraded, it has grown exponentially to a couple of GB in only a month. Has anyone ...
1
vote
1answer
1k views

How do I know if a Nessus Scan against a Oracle instance has been sucessful?

I have a Nessus Policy with all the Oracle plugins activated and the rest of the plugins disabled. I ran the scan against a fresh installation but I get nothing but the Oracle TNS Listener Remote ...
4
votes
2answers
544 views

Use Nessus or focus on manual testing?

Nessus scans for a a lot of vulnerabilities, so should I focus on learning vulnerabilities that are not covered by Nessus, like directory traversal attacks? Should I work on only the vulnerabilities ...
2
votes
2answers
680 views

How does Nessus know which services are running in a host?

I'd like to know how does a vulnerability scanner such as Nessus know which services are running, once it has scanned the ports. I don't want to know the steps to do this in Nessus, I want to know ...
1
vote
2answers
1k views

Nessus report shows iSCSI vulnerability

The IT Manager (my boss) has been running a vulnerabilities scan on a network of servers we have. The report has come back with some interesting vulnerabilities. The one I can't seem to find a lot on ...
1
vote
1answer
54 views

Network Scans Find Absent Device

Using Nessus (an uncredentialed full scan) and Nmap (essentially a full port scan), I am finding a phantom device. This device is supposed to be a well-out-of-commission device, but is returning a ...
1
vote
1answer
2k views

Vulnerability scanning of AngularJS web app fails due to '#' in url

I tried scanning my web application built with AngularJS front-end and PHP backend. But scanning with scanners like Nessus and Websecurify fails due to '#' in URL. My URL has format http://domain....
7
votes
2answers
14k views

what is the vulnerability if the DCE service on remote port is enumerated?

when I scan my server using nessus, one of the result is as follows: By sending a Lookup request to the portmapper (TCP 135 or epmapper PIPE) it was possible to enumerate the Distributed ...
1
vote
0answers
508 views

Nessus Windows Compliance Check Issue [closed]

My team and I have been trying to troubleshoot an issue we have had with the Windows compliance check not working for a custom audit. We have enabled firewall and printer connections, tried disabling ...
1
vote
3answers
748 views

Do I need an ASV to come out when going for an SAQ?

Our company is going for a SAQ, under PCI DSS 3.1. Do we need to pay a vendor to come out and do an on site scan, or can we use something like Nessus to do the scan on our own?
0
votes
3answers
1k views

How does Nessus send remote commands on Windows without RDP? [closed]

I would like to know how Nessus sends remote commands on Windows. I have a scan with credentials launched on a Windows machine without RDP enabled, and Nessus can launch commands (.audit with the item ...
3
votes
1answer
6k views

Relationship between CVSS and Risk Level in Nessus output data

In a Nessus output file, does the Risk Level (e.g. Critical, High, Medium, Low, None) depend on the CVSS score? What relationship, if any, do the Risk Level and CVSS have? Thank yo
2
votes
1answer
1k views

SMB/CIFS shares on HP-UX vulnerabilities

So, I've run an unauthenticated Nessus scan against a critical piece of infrastructure as part of a pen-test but I'm getting back some weird stuff and i can't seem to re-create the issue to ...
3
votes
2answers
4k views

How to exploit via Metasploit vulnerabilities found with Nessus?

I am new in the field and trying to pentest a php web app locally stored on my host pc using metasploit from a kali vm. I have run some scanners like wmap,OpenVAS and Nessus and found some ...
7
votes
2answers
7k views

SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection- medium or low risk?

This is a Nessus finding, which is considered medium by default. Basically it may allow for some plaintext injection which may allow for some man in the middling. My question is, has these been ...
0
votes
4answers
354 views

Software for web hacking? [closed]

I want to learn sql injection, xss and other web attacks. I am new to all this, just a beginner. I want to know which software to use. Can I use Windows for these attacks ...
0
votes
1answer
509 views

How should privileged accounts be secured in both Linux and Windows?

I have recently started work in application security at a mid-sized firm, having transitioned away from 5+ years in security consulting (pentesting, etc). One of the biggest challenges I see here from ...
0
votes
1answer
539 views

Server SSLv2 enabled on non-webservers

Using Nessus I'm scanning our internal network for vulnerabilities and exploits. I've found a large number of instances where SSLv2 is enabled and is as a result, being flagged as a vulnerability. I ...