Nessus Download For Mac

21-04-2021
 |  [RAND-100] - Comments



Vulnerability assessment tools are used to identify risks/threats that may cause security issues in a system. Today I am going to look at a vulnerability assessment tool from Tenable called Nessus Essentials, which can (manually or automatically) scan networks for vulnerabilities and then output reports.

Nessus is a multiplatform tool designed for network administrators that allows you to inspect, independent from any operating system used on the computers, any security hole that may exist on a local network or personal computer.

Professional

Download Nessus for Mac to detect potential vulnerabilities in your network. Download Nessus for Mac - Vulnerability scanner featuring high speed discovery, configuration auditing, asset profiling, sensitive data discovery.

Nessus Essentials

Nessus (https://www.tenable.com/products/nessus) offers a few different vulnerability assessment tools. The free option is Nessus Essentials, which can be used to scan 16 IP addresses and is a great way to get grips with a vulnerability assessment tool without spending any money.

Although it is free, nessus essentials does still require an activation code, which means registering for the product. Note: The activation code is one-use only. If you use it and need to reinstall nessus then you will need to to register again.

Installing Nessus

Nessus is available for various Linux systems, Windows and Mac OS X. The downloads for Nessus are available at https://www.tenable.com/downloads/nessus , make sure you choose the appropriate download for the operating system (OS) you want to install it on.

I am going to run Nessus on Ubuntu (Debian Linux) so I have download the .deb file. Once downloaded the file is installed using:

sudo dpkg -i Nessus-8.8.0-ubuntu110_amd64.deb

Note: The filename may change depending on when you are reading this blog post.

Installation should take a few minutes. I’m running Nessus on a virtual computer (via Virtual Box) which has 30GB disk space, 4GB RAM and 2 processors.

Once installed Nessus can be started (on Ubuntu) via /etc/init.d/nessusd start and once started the service can be reached via:

  • https://localhost:8834 (if you are connecting from the computer that is running Nessus)
  • https://hostname:8834 e.g. for me this is https://nessus:8834 as I have named the computer nessus (if you can resolve hosts)
  • https://IP_Address_Of_Computer:8834 e.g. for me this is https://192.168.56.3:8834 (as long as you do not have a firewall blocking access, this should be accessible from other computers on the same network)

On initial connection Nessus will ask which product you want to use. This blog entry is around the free “Nessus Esssentials” but there are trial versions of the other products available if you want to give them a try.

Nessus will then ask you to create a local nessus account for use with your installed Nessus product, and will ask for the registration key created earlier in this blog post. If you did not create a registration key then do not worry as you can do it now.

Nessus will then initialise (or initialize) and download / configure it’s plugins which can take some time depending on speed of internet connection / speed of machine etc.

Running A Scan

The various scan options are available by clicking “Scans”.

The first scan I would recommend is a “Host Discovery” as it will scan an IP range for hosts (devices) that are connected.

After this, try a “Basic Network Scan”. Nessus can take a while (depending on number of hosts, network speed etc) to report its findings but should eventually return a screen similar to the below:

The three tabs break down:

  • Hosts found and their amount of vulnerabilities
  • Vulnerability names and amount of each found
  • History

In the top right, is the option to export the findings as CSV (Comma Separated Values) or HTML (Hyper Text Markup Language), or to publish a report in PDF format.

Nessus : A security vulnerability scanning tool

Nessus Download Mac Os

voted the #1 most useful security tool ! (www.insecure.org survey )

What is Nessus?

Nessus is a remote security scanning tool, which scans a computer and raises an alert if it discovers any vulnerabilities that malicious hackers could use to gain access to any computer you have connected to a network. It does this by running over 1200 checks on a given computer, testing to see if any of these attacks could be used to break into the computer or otherwise harm it.

Who would use a tool like this?

Nessus Scanner Download Windows 10

If you are an administrator in charge of any computer (or group of computers) connected to the internet, Nessus is a great tool help keep their domains free of the easy vulnerabilities that hackers and viruses commonly look to exploit.

What Nessus is NOT

Nessus is not a complete security solution, rather it is one small part of a good security strategy. Nessus does not actively prevent attacks, it is only a tool that checks your computers to find vulnerabilities that hackers COULD exploit. IT IS UP TO THE SYSTEM ADMINISTRATOR TO PATCH THESE VULNERABILITIES IN ORDER TO CREATE A SECURITY SOLUTION.

Why Nessus?

If you are familiar with other network vulnerability scanners, you might be wondering what advantages Nessus has over them. Key points include:

- Unlike other scanners, Nessus does not make assumptions about your server configuration (such as assuming that port 80 must be the only web server) that can cause other scanners to miss real vulnerabilities.

- Nessus is very extensible, providing a scripting language for you to write tests specific to your system once you become more familiar with the tool. Its also provides a plug-in interface, and many free plug-ins are available from theNessus plug-in site. These plugs are often specific to detecting a common virus or vulnerability.

- Up to date information about new vulnerabilities and attacks. The Nessus team updates the list of what vulnerabilities to check for on a daily basis in order to minimize the window between an exploit appearing in the wild, and you being able to detect it with Nessus.

Nessus Agent Download

- Open-source. Nessus is open source, meaning it costs nothing, and you are free to see and modify the source as you wish.

- Patching Assistance: When Nessus detects a vulnerability, it is also most often able to suggest the best way you can mitigate the vulnerability.

For other advantages/features of Nessus, see: http://www.nessus.org/features.html

How Nessus Works

To learn how Nessus and other port-scanning security tools work, it is necessary to understand different services (such as a web server, SMTP server, FTP server, etc) are accessed on a remote server. Most high-level network traffic, such as email, web pages, etc reach a server via a high-level protocol that is transmitted reliably by a TCP stream. To keep different streams from interfering with each other, a computer divides its physical connection to the network into thousands of logical paths, called ports. So if you want to talk to a web server on a given machine, you would connect to port #80 (the standard HTTP port), but if you wanted to connect to an SMTP server on that same machine you would instead connect to port #25.

Each computer has thousands of ports, all of which may or may not have services (ie: a server for a specific high-level protocol) listening on them. Nessus works by testing each port on a computer, determining what service it is running, and then testing this service to make sure there are no vulnerabilities in it that could be used by a hacker to carry out a malicious attack. Nessus is called a 'remote scanner' because it does not need to be installed on a computer for it to test that computer. Instead, you can install it on only one computer and test as many computers as you would like.

Installation:

Nessus comes in two parts, a server called nessusd and a client, which can by any of several options. The server is the part of Nessus that actually runs the tests, and the client is used to tell the server what tests to run on what computers.

The server exists only for Unix/Linux platforms, but there are clients available for Unix/Linux, Windows and Mac. Therefore, once the server is set up and running, an administrator can run regularly scheduled Nessus tests using a client written for almost any platform.

Go to www.nessus.org to download the most release release of Nessus. As of this date, the current release can be found athttp://www.nessus.org/nessus_2_0.html along with extremely simple installation instructions. This will install the Nessus server app and a client on the unix based machine (note: this includes Mac OS X and above with developer tools installed). After installing the server you will have to do a couple quick configuration options, such as adding a user, described here:http://www.nessus.org/demo/first.html.

To download and install a Windows client, look at: http://nessuswx.nessus.org/

Using Nessus (part 1): Running a Scan

To run a scan, you must have the Nessus server running on some machine, then start up a Nessus client. The client will look something like this:

The two most important tabs are 'Nessusd host', which allows you to enter in the IP address of the Nessus server you will connect to, as well as the username and password needed to connect to this server. The other critical tab is labeled 'Target Selection'. This is where you specify which host(s) you would like to scan. Each tab and field is covered in depth on this webpage :http://www.nessus.org/demo/second.html.

Once you are ready to scan, hit the 'Start the scan' button.

(note: for other clients, the exact behavior of the client my deviate from what is described here, but the overall concept is the same).

Nessus

Using Nessus (part 2): Analyzing the Report

After a scan, Nessus clients typically offer to means to analyze the result. The client itself will often list each vulnerability found, gauging its level of severity and suggesting to the user how this problem could be fixed. An example screen is shown below:

Nessus clients are also able to generate more comprehensive and graphical reports in a variety of different formats. (see http://www.nessus.org/demo/third.html for examples) This can be very helpful if an administrator is scanning a large number of computers and would like to get an overall view of the state of the network.

More Information On Nessus:

The main Nessus website is www.nessus.org

Large quantities of Nessus documentation can be found at: http://www.nessus.org/documentation.html

Nessus Download Windows 10

Nessus's Freshmeat development page can be found at: http://www.freshmeat.net/projects/nessus/

Download Nessus Essentials

This page was written by Dan Wendlandt for CS197.