Vulnerability Scanning with Nmap and Nessus: Find Weaknesses Before Attackers Do

After reconnaissance tells you what exists, vulnerability scanning tells you what is weak. Port scanning with Nmap reveals which services are running. Vulnerability scanning with Nessus (or OpenVAS) identifies known weaknesses in those services.

This is the bridge between information gathering and exploitation — and it is one of the most valuable skills in cybersecurity. Security teams run vulnerability scans daily; pentesters scan at the start of every engagement; and bug bounty hunters scan every target.

Vulnerability Scanning: Nmap: the network mapper

Nmap is the most important tool in cybersecurity. It discovers hosts, scans ports, detects services, identifies operating systems, and runs vulnerability scripts — all from the command line.

# Basic scan — TCP connect scan on top 1000 ports
$ nmap 192.168.56.101

# SYN scan (stealthier, requires root) — half-open connections
$ sudo nmap -sS 192.168.56.101

# Scan ALL 65535 ports (takes longer but finds hidden services)
$ sudo nmap -sS -p- 192.168.56.101

# Service version detection — what software and version?
$ nmap -sV 192.168.56.101
PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 2.3.4  ← known backdoor!
22/tcp   open  ssh         OpenSSH 4.7p1
80/tcp   open  http        Apache 2.2.8
3306/tcp open  mysql       MySQL 5.0.51a

# OS detection — what operating system?
$ sudo nmap -O 192.168.56.101
OS details: Linux 2.6.9 - 2.6.33

# Aggressive scan (version + OS + scripts + traceroute)
$ sudo nmap -A 192.168.56.101

# UDP scan (slow but finds services like DNS, SNMP, TFTP)
$ sudo nmap -sU --top-ports 100 192.168.56.101

# Scan an entire subnet:
$ nmap -sn 192.168.56.0/24  # ping sweep — find live hosts

Nmap Scripting Engine (NSE): automated vulnerability detection

NSE turns Nmap from a scanner into a full vulnerability assessment tool. It has over 600 scripts for everything from brute-forcing passwords to detecting specific CVEs.

# Run default safe scripts:
$ nmap -sC 192.168.56.101

# Run vulnerability detection scripts:
$ nmap --script vuln 192.168.56.101
# Output:
# | smb-vuln-ms17-010:
# |   VULNERABLE: Remote Code Execution (EternalBlue)
# |   Risk factor: HIGH  CVE: CVE-2017-0144

# Check for specific vulnerability:
$ nmap --script smb-vuln-ms17-010 -p445 192.168.56.101

# Brute force FTP login:
$ nmap --script ftp-brute -p21 192.168.56.101
# | ftp-brute:
# |   Accounts:
# |     admin:admin - Valid credentials

# HTTP enumeration — find directories and interesting pages:
$ nmap --script http-enum -p80 192.168.56.101
# | http-enum:
# |   /admin/: Admin panel
# |   /phpmyadmin/: phpMyAdmin
# |   /test/: Test page

# Check for heartbleed (OpenSSL vulnerability):
$ nmap --script ssl-heartbleed -p443 target.com

# List all available scripts:
$ ls /usr/share/nmap/scripts/ | wc -l
604

Nessus: comprehensive vulnerability assessment

While Nmap finds open ports and runs targeted scripts, Nessus performs comprehensive vulnerability assessments — checking thousands of known vulnerabilities against every discovered service, with severity ratings and remediation advice.

# Install Nessus Essentials (free, 16 IPs)
# Download from https://www.tenable.com/products/nessus/nessus-essentials

# On Kali/Debian:
$ sudo dpkg -i Nessus-*.deb
$ sudo systemctl start nessusd

# Access web interface:
# https://localhost:8834
# Create account, activate with free key

# Create a new scan:
# 1. Templates → Basic Network Scan
# 2. Target: 192.168.56.101
# 3. Launch scan

# Results show vulnerabilities by severity:
# CRITICAL: vsftpd 2.3.4 Backdoor (CVSS 10.0)
#   → Exploitable: attacker gets root shell
#   → Fix: upgrade to vsftpd 3.0+
#
# HIGH: MySQL remote root login (CVSS 7.5)
#   → root account accessible without password
#   → Fix: set root password, restrict to localhost
#
# MEDIUM: Apache outdated (CVSS 5.0)
#   → Multiple known CVEs
#   → Fix: upgrade to Apache 2.4+

# Alternative: OpenVAS (fully free)
$ sudo apt install openvas
$ sudo gvm-setup  # takes ~30 min initial setup

Interpreting scan results and prioritizing vulnerabilities

A scan might return hundreds of findings. Prioritize by:

1. CVSS score — 9.0-10.0 Critical, 7.0-8.9 High, 4.0-6.9 Medium, 0.1-3.9 Low.
2. Exploitability — is there a public exploit? A Metasploit module? If so, attackers will find it too.
3. Impact — does it give remote code execution (worst) or just information disclosure (less severe)?
4. Exposure — is it internet-facing or only on an internal network?
5. Asset value — a vulnerability on the database server matters more than on a test server.

Always verify critical findings manually before reporting. Scanners produce false positives — reporting unverified findings damages your credibility.

When evaluating vulnerability scanning, start with the fundamentals: what problem it solves, who it serves, and how it compares to the alternatives buyers consider first.

Start with the fundamentals. Define who you are serving, the single outcome you want, and the budget you are comfortable committing before you compare any options.

A practical rule is to favour clarity over cleverness. The choice that is easiest to understand, spell, remember and act on tends to win over the long run.

Context changes the answer. What is optimal for a fast-moving startup is rarely optimal for an established brand, so weigh your own stage, market and ambitions.

Avoid the common mistakes: rushing the decision, copying competitors blindly, and ignoring the total cost of ownership beyond the very first year of use.

Think in terms of trade-offs rather than a single perfect answer. Every option trades memorability, cost, reach and flexibility in a slightly different mix.

Document your reasoning. Writing down why you chose one path makes it far easier to revisit the decision later and to explain it to partners and investors.

Test with real people. A quick check with a handful of your actual customers will surface problems that no amount of internal debate ever reveals.

Plan for growth. The option that fits today should still make sense when your audience, catalogue or team is several times larger than it is right now.

Finally, revisit the decision periodically. Markets, tools and best practices move quickly, and a choice that was ideal last year may deserve a fresh look today.

When evaluating vulnerability scanning, start with the fundamentals: what problem it solves, who it serves, and how it compares to the alternatives buyers consider first.

Frequently asked questions

Will vulnerability scanning set off alarms?

Yes. Modern IDS/IPS systems detect Nmap scans, especially aggressive ones. In professional engagements, coordinate with the target's security team. For your lab, this does not matter. In bug bounty, check the program's rules — most allow scanning.

Nmap vs Nessus — which should I learn first?

Nmap first. It teaches you how scanning works at a fundamental level. Nessus is a push-button scanner that hides the complexity. Understanding what Nmap does makes you better at interpreting Nessus results.

Is Nessus free?

Nessus Essentials is free for up to 16 IPs — plenty for a home lab. The professional version costs ~$3,500/year. OpenVAS is a fully free alternative with similar capabilities but a steeper learning curve.