‫So let's have a look at NASA's developed by Tenable Network security is one of the most popular and
‫capable vulnerability scanners.
‫NASA's professional is a commercial product.
‫In addition, a free NASA's home version is also available, though it's limited and only licensed for
‫home network use.
‫NASA's allow scans for the following types of vulnerabilities.
‫Vulnerabilities that allow a remote hacker to control or access sensitive data on a system.
‫Misconfiguration, for example, open mail relay, missing patches etc default passwords, a few common
‫passwords and blank or absent passwords on some system accounts.
‫Neces can also call Hydra an external tool to launch a dictionary attack.
‫Denials of service against the TCP IP stack by using malformed packets.
‫And preparation for PCI, DSS audits.
‫Now, in a typical operation, Nasir's begins by doing a port scan to determine which ports are open
‫on the target and then tries various exploits on the open ports.
‫The vulnerability tests available as subscriptions are written in NASL Nessus attack scripting language,
‫a scripting language optimized for custom network interaction.
‫NASA's is constantly updated with more than 70000 plug ins.
‫Key features include remote and local authenticated security checks, a client server architecture with
‫a web based interface, and an embedded scripting language for writing your own plug ins or understanding
‫the existing one.
‫Optionally, the results of the scan can be reported in various formats, such as plain text, XML,
‫HTML and latex.