CompTIA Security+ Preparation · lesson 37 of 45 · 25 min
Vulnerability Scanning Tools
Nessus — most widely used commercial vulnerability scanner. Developed by Tenable. Scans for: missing patches, misconfigurations, default credentials, open ports, weak ciphers. Produces detailed reports with CVSS scores and remediation guidance. Nessus Essentials is free for up to 16 IPs.
OpenVAS (Greenbone) — open-source vulnerability scanner. Free alternative to Nessus. Part of the Greenbone Vulnerability Management (GVM) platform. Regularly updated vulnerability tests.
Qualys — cloud-based vulnerability management platform. Agentless scanning via cloud connectors. Continuous monitoring. Used for large enterprise environments.
Nikto — open-source web server scanner. Checks for: outdated software, dangerous files, server misconfigurations, default files. Not stealthy — generates significant log entries.
Nmap — network mapper. Port scanning, service detection, OS fingerprinting, script scanning (NSE). Not a full vulnerability scanner but essential for reconnaissance.
Burp Suite — web application security testing. Proxy, scanner, intruder, repeater. Community edition is free. Professional edition includes automated scanner.
Interpreting Scan Results
Scan output includes: host IP, open ports, detected services and versions, identified vulnerabilities with CVE IDs and CVSS scores, plugin output (evidence), remediation recommendations.
Credentialed vs uncredentialed scans: Credentialed (authenticated) scans provide much more detail — they can check installed software versions, registry settings, and local configurations. Uncredentialed scans only see what is exposed over the network.
Scan frequency: Critical systems: weekly or continuous. Standard systems: monthly. After major changes: immediately.
Prioritizing results: CVSS 9.0+ → patch immediately. Exploitable vulnerabilities → prioritize over theoretical. Internet-facing systems → higher priority than internal. Critical assets → higher priority.
False positives — verify manually before reporting. Scanners sometimes flag vulnerabilities that are mitigated by compensating controls or are not actually present.
Key Terms
Key Terms
Knowledge Check — 10 Questions
Security+ — Vulnerability Scanning Tools
Nessus is primarily used for:
- Web application testing
- Network vulnerability scanning with CVSS-scored findings
- Password cracking
- Network packet capture
- Answer: Network vulnerability scanning with CVSS-scored findings
Nessus scans hosts for missing patches, misconfigurations, and vulnerabilities — producing reports with CVE IDs and CVSS scores. A credentialed scan provides more detail because: It scans faster It authenticates to the target and can check installed software, registry, and local configs
- It uses more network bandwidth
- It requires no configuration
Answer: It authenticates to the target and can check installed software, registry, and local configs Credentialed scans log into the target — they can see everything installed, not just what is exposed over the network. Nikto is used to scan:
- Network infrastructure
- Web servers for misconfigurations and outdated software
- Wireless networks
- Database servers only
- Answer: Web servers for misconfigurations and outdated software
Nikto checks web servers for dangerous files, outdated software versions, and common misconfigurations. Burp Suite is primarily used for:
- Network vulnerability scanning
- Web application security testing
- Password auditing
- Log analysis
- Answer: Web application security testing
Burp Suite is the standard tool for web app security testing — it proxies HTTP traffic, scans for vulnerabilities, and enables manual testing. After a major system change, vulnerability scanning should occur:
- In the next scheduled monthly scan
- Immediately after the change
- Only annually
- Only if the change was high-risk
- Answer: Immediately after the change
Changes can introduce new vulnerabilities — scan immediately after major changes to catch any issues before attackers do. OpenVAS is:
- A commercial scanner from Tenable
- An open-source vulnerability scanner (Greenbone)
- A web application firewall
- A SIEM platform
- Answer: An open-source vulnerability scanner (Greenbone)
OpenVAS (now part of Greenbone Vulnerability Management) is the leading open-source vulnerability scanner — free and regularly updated.
When prioritizing scan results, which should be addressed first?
- Low CVSS score vulnerabilities on internal systems
- Critical CVSS 9.0+ vulnerabilities on internet-facing systems
- Medium vulnerabilities on non-critical systems
- All vulnerabilities equally
Answer: Critical CVSS 9.0+ vulnerabilities on internet-facing systems
Prioritize: high CVSS + internet-facing + critical asset + actively exploited. These represent the greatest immediate risk.
Nmap is best described as:
- A full vulnerability scanner
- A network mapper for port scanning, service detection, and OS fingerprinting
- A web application scanner
- A password auditing tool
- Answer: A network mapper for port scanning, service detection, and OS fingerprinting
Nmap discovers hosts, open ports, services, and OS versions — essential for reconnaissance but not a full vulnerability scanner. A false positive in a vulnerability scan means:
- A real vulnerability was missed
- A vulnerability is reported that does not actually exist
- The scan completed successfully
- The CVSS score is too high
- Answer: A vulnerability is reported that does not actually exist
False positives require manual verification — the scanner flagged something that is not actually exploitable or is mitigated by a compensating control.
Qualys is a _____ -based vulnerability management platform used in large enterprises.
Answer: cloud
Qualys is cloud-based — it provides agentless scanning, continuous monitoring, and compliance reporting without on-premises infrastructure.
Previous lesson: Security automation: SOAR, playbooks, scripting for security operations
Back to CompTIA Security+ Preparation
Next lesson: Risk management: identification, analysis, treatment, monitoring