‫So let's have a look at Nessa's developed by tenable network security is one of the most popular and
‫capable vulnerability scanners.
‫NASA's professional is a commercial product.
‫In addition, a free Nessa's home version is also available, although it's limited and only licensed
‫for home network use.
‫Nessus allow scans for the following types of vulnerabilities.
‫Vulnerabilities that allow a remote hacker to control or access sensitive data on a system.
‫Misconfiguration, for example, open mail relais, missing patches, etc., default passwords, a few
‫common passwords and blank or absent passwords on some system account, Nessa's can also call Hydra
‫an external tool to launch a dictionary attack.
‫Denial of service against the TCP IP stack by using malformed packets in preparation for PCI DNS audits.
‫In a typical operation, Nessa's begins by doing a port scan to determine which ports are open on the
‫target and then tries various exploits on the open ports.
‫The vulnerability tests available as subscriptions are written in NASL, Nessus Attack Scripting Language,
‫a scripting language optimized for custom network interaction.
‫Nessa's is constantly updated with more than 70000 plug ins.
‫Key features include remote and local authenticated security checks, a client server architecture with
‫a Web based interface, and an embedded scripting language for writing your own plug ins or understanding
‫the existing one.
‫Obviously, the results of the scan can be reported in various formats, such as plain text, XML,
‫HTML and latex.