Nessus Essentials: Vulnerability Scanning Your Home Lab

Part of our free Tools & Targets series. Hands-on guides to the vulnerable practice apps and the security tools you will use on the job. Pair it with our Build Your Own Cyber Lab series for the lab to run them in.

1. Vulnerable practice apps: DVWA, bWAPP, Juice Shop, WebGoat, AI Goat and more
2. DVWA walkthrough: every module solved at Low, Medium and High
3. OWASP Juice Shop: beginner and intermediate challenges solved
4. WebGoat and bWAPP: key lessons solved
5. Threat modeling your lab with OWASP Threat Dragon
6. Nessus Essentials: vulnerability scanning your lab (you are here)
7. Snort and Suricata: network IDS and your first rules
8. Splunk in your lab: install, forward Windows logs, search with SPL
9. Wazuh deep dive: file integrity, vulnerability detection and custom rules

Why a vulnerability scanner belongs in your lab

Vulnerability management is one of the most common entry-level security jobs, and nearly every organisation runs a scanner such as Nessus, Qualys or OpenVAS. CySA+, PenTest+ and Security+ all test how to read scan output, tell a true finding from a false positive, and prioritise remediation. The fastest way to learn that is to scan a machine you know is full of holes: Metasploitable 2 from part 8 of our home-lab series.

Step 1: Understand the Essentials licence first

Nessus Essentials is Tenable's free edition for personal, educational and non-commercial use. Its terms have changed over the years, so check the current limits on Tenable's Nessus Essentials page before you plan your lab. At the time of writing that page described a licence limited to a small number of IP addresses (5), valid for 30 days, with delayed plugin updates, and without reporting, data export or compliance checks; scan data is not kept when the licence expires.

Two practical consequences:

• Pick your targets carefully. A small IP cap means "scan the whole lab subnet" is out. Scan Metasploitable 2 and one or two other targets, not the /24.
• Write findings down as you go if your edition cannot export. Your notes are the deliverable.

To get an activation code, fill in the registration form on the Nessus Essentials page with your details. Tenable emails the code and a download link.

Step 2: Install Nessus on Ubuntu

Use the Ubuntu Server VM from part 5, with at least 4 GB RAM (more is better while plugins compile) and two network adapters: one with internet access for registration and plugin downloads, and one on the isolated ATTACK network where Metasploitable lives.

1. Download the Debian/Ubuntu .deb package for your architecture from Tenable's download page.
2. Install it and start the service (Tenable's Linux install page shows these exact forms):

sudo dpkg -i Nessus-<version>-<platform>_amd64.deb   # use the exact file name you downloaded
sudo systemctl start nessusd
sudo systemctl enable nessusd    # optional: start at boot

3. Browse to https://<nessus-server-ip>:8834. The certificate is self-signed, so accept the browser warning for this lab host only.
4. Choose Nessus Essentials, enter the activation code, and create a local admin account.

The plugin compile wait

After activation Nessus downloads its plugins and then compiles them. This takes a while - often tens of minutes, sometimes longer on a small VM - and the web interface shows a progress bar. Scans will not run properly until it finishes, so make a coffee rather than restarting the service.

Step 3: Choose the right scan type

Create scans from New Scan and pick a template. The three you will use most:

Why credentialed scans find more

An unauthenticated scan only sees what a service advertises over the network: banners, protocol behaviour and responses to probes. It must guess the patch level from a version string, which is both noisy and incomplete. A credentialed scan logs in and reads the installed package list, kernel version, file permissions and configuration directly. It finds local privilege-escalation bugs, missing patches with no network exposure, and weak settings that an outside scan can never see, and it produces fewer false positives because it checks the installed version rather than a banner.

Step 4: Scan Metasploitable 2

Confirm first that Metasploitable 2 is on the isolated ATTACK network and nothing else is in the target range.

1. New Scan > Basic Network Scan. Name it "MS2 - unauthenticated" and enter only the Metasploitable IP as the target.
2. Launch and wait. A single deliberately vulnerable host produces a long list.
3. Now duplicate it as "MS2 - credentialed". Under Credentials, add SSH with the well-known default Metasploitable account documented by Rapid7 (msfadmin / msfadmin). Launch again.
4. Compare the two runs: the credentialed scan should report many more missing-patch findings from inside the OS.

Step 5: Read the results like an analyst

Open a scan and click into any finding. Each one is produced by a plugin and shows:

• Severity - Critical, High, Medium, Low or Info.
• CVSS score - the industry-standard base score from FIRST. It measures how bad the flaw is in the abstract.
• VPR (Vulnerability Priority Rating), where shown - Tenable's own score that adds threat intelligence such as active exploitation. A CVSS 9.8 nobody exploits may rank below a CVSS 7.5 that ransomware gangs use daily.
• Plugin output - the evidence: the banner, version string or file Nessus actually saw. Always read this; it is how you verify a finding.
• Solution - the vendor fix or workaround, plus references (CVE IDs, advisories).

Findings you should expect on Metasploitable 2 include an unsupported operating system, the vsftpd 2.3.4 backdoor, a rogue bind shell listening on a high port, the UnrealIRCd backdoor, weak VNC credentials, and several outdated web components. Cross-check them with Rapid7's Metasploitable 2 exploitability guide.

Step 6: Handle false positives properly

Scanners are evidence, not verdicts. A finding is a false positive when the plugin output does not actually prove the condition, for example:

• A version banner that a backported distribution patch has already fixed (common with unauthenticated scans of Linux packages).
• A service that answers on a port but is not the software the plugin assumed.

Verify manually: connect to the port, check the installed package version with credentials, or reproduce the issue safely. If it really is a false positive, record why. Nessus lets you recast or hide a finding's severity in some editions; in a real job you would raise an exception with an owner and an expiry date rather than silently deleting it.

Step 7: Fix, then rescan

Remediation is not finished until a rescan proves it. Pick one finding on Metasploitable and fix it:

• The rogue bind shell is started from /etc/inetd.conf. Comment out the line that starts the shell on that port, then reboot the VM.
• Change the VNC password to something long and random.

Re-launch the same scan and compare. The fixed findings should disappear. If one remains, read the plugin output again - it tells you exactly what Nessus still sees.

Step 8: Record the results

Where your edition supports it, use the scan's Report or Export options. If the Essentials licence you have does not include export, write a short findings table yourself: host, finding, severity, CVSS, evidence, fix, retest result. That table, plus a paragraph on how you prioritised, is exactly what a vulnerability-management interviewer wants to see.

The open-source alternative: Greenbone/OpenVAS

Greenbone Community Edition (the OpenVAS scanner and its management stack) is free and open source, has no IP cap, and can export reports. It is heavier to install - the Greenbone docs cover a container setup and source builds - and its feed is the community feed rather than the commercial one. Running both against the same target and comparing what each finds is an excellent exercise in scanner coverage and false positives.

Keep it legal and contained

Only scan, probe or attack machines you own or have written permission to test. Keep vulnerable targets on an isolated lab network with no route to your home LAN or the internet, and never point a scanner or exploit at an address you do not control - even "just to see" is unauthorised access in most jurisdictions.

Next step

Part 7 moves from finding weaknesses to watching for attacks on the wire with Snort and Suricata. To practise prioritising findings and tracing an attack path without installing anything, try our pentest path lab and cyber range.