Introduction
Vulnerability scanning is an important part of cybersecurity because it helps security teams identify weaknesses in servers, operating systems, applications, configurations, and installed software before attackers can exploit them.
In this lab environment, Nessus by Tenable is installed on a Kali Linux machine and is used to scan two target systems:
Ubuntu Linux Server
Windows Server 2022
The Linux server is scanned using SSH (Secure Shell), while the Windows Server is scanned using SMB (Server Message Block).
This approach demonstrates an authenticated vulnerability assessment, where Nessus is provided with valid credentials so that it can perform deeper security checks.
1. Lab Architecture
The environment contains three primary components:
| System |
|
Role |
| Kali Linux + Nessus |
192.168.56.10 |
Vulnerability Scanner |
| Ubuntu Linux |
192.168.56.20 | Linux Target |
| Windows Server 2022 |
192.168.56.30 |
Windows Target |
| Network |
192.168.56.0/24 |
Internal LAN |
2 Nessus Scanner – Kali Linux
The Nessus vulnerability scanner is installed on the Kali Linux machine.
Kali IP : 192.168.56.10
The Kali machine acts as the central vulnerability scanning system.
Nessus can identify vulnerabilities by performing different types of checks, including:
Operating-system detection
Missing security patches
Vulnerable software versions
Weak configurations
Open network services
Security configuration problems
Installed packages
Authentication-related weaknesses
Known CVEs
Compliance-related configuration issues
The Nessus web interface is used to configure targets, credentials, scan policies and review results.
3. Linux Target – Ubuntu Server
The first target is a Linux server.
IP Address: 192.168.56.20
Operating System: Ubuntu 22.04
Service: SSH
Port: TCP 22
The Linux server exposes SSH on port 22.
Nessus uses SSH to establish an authenticated connection to the server.
Kali/Nessus
192.168.56.10
│
│ TCP 22
│ SSH
▼
Ubuntu Linux
192.168.56.20
4. Why Does Nessus Use SSH?
SSH allows Nessus to perform much deeper checks than a basic unauthenticated network scan.
With appropriate authorization and credentials, Nessus can inspect information such as:
- Operating-system version
- Kernel version
- Installed packages
- Package versions
- Security updates
- System configuration
- Running services
- Configuration files
- Security settings
- Vulnerable software
- Missing patches
For example, an unauthenticated scanner might determine:
Port 22 is open
SSH service detected
But an authenticated scan can potentially determine:
Ubuntu version
Kernel version
Installed packages
Package versions
Missing security updates
Configuration weaknesses
Vulnerable software
This makes authenticated scanning much more useful for internal vulnerability assessments.
6. Windows Server 2022 Target
The second target is a Windows Server 2022 system.
IP Address: 192.168.56.30
Operating System: Windows Server 2022
Service: SMB
Port: TCP 445
Nessus communicates with the Windows server using Windows authentication mechanisms associated with SMB.
The connection can be represented as:
Kali/Nessus
192.168.56.10
│
│ TCP 445
│ SMB
▼
Windows Server 2022
192.168.56.30
7. Why Is SMB Port 445 Important?
TCP port 445 is commonly used by SMB for Windows file and network resource sharing.
Nessus can use authenticated Windows access to gather information required for deeper vulnerability analysis.
Depending on the scan configuration and permissions, Nessus can examine:
- Windows version
- Installed security updates
- Installed applications
- Software versions
- Registry/configuration information
- Windows security settings
- Missing patches
- Vulnerable software
- System configuration
- Security-related settings
Without authentication, Nessus may only be able to identify externally visible services and vulnerabilities.
With authentication, it can perform considerably deeper checks.
8. Nessus Scan Configuration.
In Nessus, the administrator creates a scan and specifies the target systems.
For this lab:
Targets:
192.168.56.20
192.168.56.30
The Linux credentials are configured for:
192.168.56.20
and Windows credentials are configured for:
192.168.56.30
The appropriate Nessus plugins are then used to perform vulnerability checks.
9. Scan Flow
The complete scanning process can be understood in five stages.
Step 1 – Configure Nessus
The administrator opens the Nessus web interface and creates a vulnerability scan.
The target IP addresses are entered:
192.168.56.20
192.168.56.30
10. Nessus Connects to Linux
Nessus establishes an SSH connection:
192.168.56.10
│
│ TCP 22
▼
192.168.56.20
After successful authentication, Nessus performs local checks.
Nessus Connects to Windows
Nessus connects to the Windows Server using SMB:
192.168.56.10
│
│ TCP 445
▼
192.168.56.30
It then performs authenticated Windows vulnerability checks.
11. Vulnerability Analysis
Nessus analyzes information collected from both systems.
It can identify issues such as:
Critical vulnerabilities
High vulnerabilities
Medium vulnerabilities
Low vulnerabilities
Informational findings
This Nessus lab demonstrates how a vulnerability scanner can assess both Linux and Windows environments using authenticated connections.
The Kali Linux machine hosts Nessus and acts as the scanning platform. Nessus connects to the Ubuntu Linux server using SSH on TCP port 22 and connects to the Windows Server 2022 system using SMB on TCP port 445.
The major advantage of authenticated scanning is that Nessus can obtain much deeper information about the target systems than a basic network scan. This allows security teams to identify missing patches, vulnerable software, configuration weaknesses and other security issues more accurately.
This type of architecture is useful for cybersecurity labs, vulnerability-management programs, penetration-testing preparation, security assessments and enterprise infrastructure security monitoring.
Comments
Post a Comment