Common Scanning Tools: Nessus, OpenVAS, Nmap

Security professionals use a variety of scanning tools for different purposes: host discovery, port scanning, service enumeration, operating system detection, vulnerability identification, and web application testing. Security+ expects familiarity with the most widely used tools in each category. Understanding what each tool does — and what it cannot do — helps you select the right tool for a given task and interpret results correctly. Results from multiple complementary tools provide more complete coverage than any single tool alone.

Nmap (Network Mapper) is the most widely used open-source tool for network discovery and security auditing. It can discover live hosts, enumerate open ports, detect running services and their versions, and identify the operating system. Nmap uses various scan techniques including SYN scan (the default, fast and relatively stealthy), TCP Connect (full handshake, noisier but doesn't need root), UDP scan, and version scan. It ships with the Nmap Scripting Engine (NSE) which provides hundreds of scripts for vulnerability detection, brute-forcing, and exploitation.

Interpreting Nmap output correctly is an essential skill. Each line represents a port with its state (open: service is listening, closed: host responded but nothing is listening, filtered: no response or ICMP unreachable, likely firewalled), protocol, and detected service/version. Open ports represent potential attack surface. Unexpected open ports on a host may indicate compromise or unauthorized services. The -oN, -oX, and -oG flags save output in normal, XML, and grepable formats — saving output is critical for documentation and comparison across scans over time.

Nessus (by Tenable) is the most widely deployed commercial vulnerability scanner. It uses a plugin architecture with 100,000+ plugins covering CVEs, configuration checks, compliance benchmarks (CIS, DISA STIG), and malware detection. Nessus performs credentialed scans by logging into systems with provided credentials to inspect installed software versions, registry keys, and configuration files — producing far more accurate results than uncredentialed network probing. Nessus produces detailed reports with CVSS scores, vulnerability descriptions, and remediation recommendations. The free Nessus Essentials version scans up to 16 IPs.

OpenVAS (Open Vulnerability Assessment System) is a free, open-source vulnerability scanner maintained by Greenbone Networks. It is the community-supported fork of the original Nessus before it went commercial. OpenVAS uses NVTs (Network Vulnerability Tests) analogous to Nessus plugins. The Greenbone Community Edition (GCE) provides a web-based management interface (Greenbone Security Assistant). OpenVAS is popular in environments where licensing costs prevent using commercial tools. It has a broader feature set than Nmap while remaining free, making it a common choice for smaller organizations, academic environments, and security labs.

Nikto is an open-source web server scanner that checks for dangerous files, outdated software versions, server configuration problems, and common web vulnerabilities. It tests for over 6,700 known issues including insecure HTTP methods, missing security headers, exposed admin interfaces, default credentials, and common CGI vulnerabilities. Nikto is noisy and not designed for stealth — it generates significant logs on the target. It complements network-level scanners by providing web-specific checks that Nessus and OpenVAS may not cover in depth. Always use Nikto only on systems you are authorized to test.

The Metasploit Framework is the most widely used penetration testing platform, providing a database of exploits, payloads, auxiliary modules, and post-exploitation tools. Security+ candidates should understand what Metasploit is and how it fits into a pen test, even if they have never used it. Metasploit modules include: exploits (code that takes advantage of a vulnerability), payloads (shellcode that runs after successful exploitation, like Meterpreter), auxiliary modules (scanning, fuzzing, enumeration without exploitation), and post modules (for privilege escalation, credential dumping, lateral movement after initial access).

Netcat (nc) is a simple but versatile utility that reads and writes data across network connections using TCP or UDP. It has countless uses in security work: establishing reverse shells from compromised hosts, transferring files across network segments, port scanning, creating simple network listeners for testing, and banner grabbing to identify service versions. Its simplicity and availability on almost every Linux system make it a frequently used tool in both legitimate administration and attacker toolkits, making it an important tool to understand from a detection perspective as well.

Recon-ng is a web reconnaissance framework designed for OSINT (Open Source Intelligence) gathering. It uses modules that query public sources — Shodan, Bing, HaveIBeenPwned, DNS records, LinkedIn, WHOIS, and certificate transparency logs — to gather information about a target before any active scanning begins. The reconnaissance phase of a pen test typically starts with OSINT to build a picture of the target's network topology, employee names, email formats, technologies used, and publicly exposed assets. Good OSINT can reveal attack paths that would take much longer to find through active scanning alone.

Enum4linux enumerates information from Windows hosts and Samba (Linux SMB) servers using null sessions and MSRPC. It extracts usernames, group memberships, shares, password policies, and workgroup information. During internal pen tests, enum4linux can rapidly reveal the user accounts available for password spraying and the share structure of an environment. Modern Windows versions restrict null session access by default, but poorly configured environments often expose substantial information. Similar capabilities are available in Impacket's samrdump.py and CrackMapExec for authenticated enumeration.

Security professionals match tools to tasks. For host discovery and port scanning: Nmap. For vulnerability identification at scale: Nessus (commercial) or OpenVAS (free). For web server vulnerabilities: Nikto. For web application attacks: Burp Suite. For exploitation: Metasploit. For OSINT reconnaissance: Recon-ng, theHarvester, Shodan. For network traffic analysis: Wireshark, tcpdump. For wireless attacks: Aircrack-ng suite. The Security+ exam tests conceptual knowledge of these tools — you should know what each is used for even without hands-on experience with every one.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: Nmap is the foundation for host discovery, port scanning, and version detection with a rich scripting engine for additional capabilities, Nessus and OpenVAS perform comprehensive vulnerability scanning against known CVEs using credentialed access for greatest accuracy, and Metasploit provides an exploit framework for pen testers to confirm vulnerabilities are actually exploitable and demonstrate real attack impact. Next up we explore the full penetration testing lifecycle from reconnaissance to reporting.