This article needs additional citations for verification. (February 2013) (Learn how and when to remove this template message)
8.10.1 / May 19, 2020
|Platform||Mac, Windows, Linux|
|License||Proprietary; GPL (2.2.11 and earlier)|
Examples of vulnerabilities and exposures Nessus can scan for include:
- Vulnerabilities that could allow unauthorized control or access to sensitive data on a system.
- Misconfiguration (e.g. open mail relay, missing patches, etc.).
- Default passwords, a few common passwords, and blank/absent passwords on some system accounts. Nessus can also call Hydra (an external tool) to launch a dictionary attack.
- Denials of service vulnerabilities
Nessus scans cover a wide range of technologies including operating systems, network devices, hypervisors, databases, web servers, and critical infrastructure.
The results of the scan can be reported in various formats, such as plain text, XML, HTML and LaTeX. The results can also be saved in a knowledge base for debugging. On UNIX, scanning can be automated through the use of a command-line client. There exist many different commercial, free and open source tools for both UNIX and Windows to manage individual or distributed Nessus scanners.
Nessus provides additional functionality beyond testing for known network vulnerabilities. For instance, it can use Windows credentials to examine patch levels on computers running the Windows operating system. Nessus can also support configuration and compliance audits, SCADA audits, and PCI compliance.
The Nessus Project was started by Renaud Deraison in 1998 to provide to the Internet community with a free remote security scanner. On October 5, 2005, Tenable Network Security, the company Renaud Deraison co-founded, changed Nessus 3 to a proprietary (closed source) license.
Today, the product still exists in two formats; a limited, free version and a full-feature paid subscription option. Nessus is available for Linux, Windows, and Mac OS X. Tenable, Inc. went public on July 26, 2018, twenty years after Nessus’ creation.
- Penetration test
- Metasploit Project
- Security Administrator Tool for Analyzing Networks (SATAN)
- SAINT (software)
- Snort (software)