Nessus: vulnerability scanning

Nessus doesn’t ship with Kali and needs a manual installation, but it’s worth having around for engagements where a broader, CVE-tagged vulnerability report matters more than Metasploit’s more exploit-focused auxiliary scanners.

• Official installation guide
• Guide on using it with Metasploit

Install and start

zypper install -y hostname       # dependency on some minimal images

# download the Debian/amd64 .deb from tenable.com/downloads, then:
sudo dpkg -i <nessus_package>.deb
/bin/systemctl start nessusd.service

CLI and web UI

# CLI lives here
/opt/nessus/sbin/nessuscli <args>
nessuscli update --plugins-only    # or --all

# Web UI
# https://127.0.0.1:8834

Export to Metasploit

# Feed results into Metasploit once exported
db_import <path_to_exported_results>

Tips

• Authenticated scans need credentials under the Credentials tab; scan scope/ports live under Discovery, and vulnerability categories under Assessment.
• Results include CVE identifiers directly, which makes cross-referencing against searchsploit or an MSF module straightforward afterward.

Related

• From service version to working exploit: where scan results turn into exploits
• Metasploit Framework: database and db_import basics
• searchsploit: look up the CVEs Nessus reports
• WMAP: Metasploit’s built-in web scanner