So let's have a look at Nessus developer by Tenable Network Security is one of the most popular and capable
vulnerability scanner. Nessus Professional is a commercial product.
In addition, a free Nessus Home version is also available though, it's limited and only licensed for home
network use.
Nessus allow scans for the following types of vulnerabilities. Vulnerabilities that allow a remote hacker
to control or access sensitive data on a system. • Misconfiguration (e.g. open mail relay, missing
patches, etc.) . Default passwords,
few common passwords and blank or absent passwords on some system accounts. Nessus can also call Hydraa
(an external tool) to launch a dictionary attack. Denials of service against the TCP/IP stack by using
malformed packets. Preparation for PCI DSS audits. In a typical operation Nessus begins by doing a
port scan to determine which ports are open on the target and then tries various exploits on the open
ports.
The vulnerability tests available as subscriptions are written in NASL (Nessus attacks scripting language).
Scripting language optimized for custom network interaction. Nessus is constantly updated with more than
70000 plugins. Key features include remote and local authenticated security checks.
A client/server architecture with a web based interface and an embedded scripting language for writing
your own plugins or understanding the existing one. Optionally only the results of the scan can be reported
in various formats such as plain text, XML, HTML and LaTeX.