Nessus
Commercial vulnerability scanner: the reference for authenticated assessment.
Tenable's vulnerability scanner, the industry reference and the one taught in the CPTS *Vulnerability Assessment* module. It is driven from a web interface on port 8834, and its big difference from an nmap scan is the **authenticated scan**: with system credentials it logs in over SMB or SSH and reads installed versions and patches instead of guessing from the banner, which removes almost every false positive. It produces the CVSS finding report handed to the client; useless on a CTF, half the job on a real engagement.
Family Vulnerabilities & exploits
Flags (interfaz web en 8834)
Concepts From version to exploit
Cheatsheet Discovery & scanning
Installation
# Nessus Essentials (free; the activation code arrives by email)
# 1) Download the .deb from Tenable's site and install it:
sudo dpkg -i Nessus-*-debian10_amd64.deb
# 2) Start the service:
sudo systemctl enable --now nessusd
# 3) Open https://localhost:8834 and finish registration + plugin downloadUseful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.