Wednesday, August 27, 2008

Vulnerability Scanners | Nessus | Free Download

Nessus is a free, easy to use remote vulnerability scanner that is a client-server application. The application is hosted on a server (typically a Unix server), where the software can be kept up-to-date. Nessus scans any system, whether it runs Windows, Mac OS or Unix/Linux. A client server application such as Nessus makes it possible to keep one easily-updatable software on a server and makes it easily accessible by as many clients as desired. Nessus also "doesn't take anything for granted" (nessus.org). No matter how your server or workstation is set up or what operating system it uses, it will scan for security vulnerabilities. For example, say your typical webserver is serving a site on port 8080 instead of the regular port 80. Nessus will scan all open ports, regardless of common and defaulted settings. other example below
  • Vulnerabilities that allow a remote cracker to control or access sensitive data on a system.
  • Misconfiguration (e.g. open mail relay, missing patches, etc).
  • Default passwords, a few common passwords, and blank/absent passwords on some system accounts. Nessus can also call Hydra (an external tool) to launch a dictionary attack.
  • Denials of service against the TCP/IP stack by using mangled packets

On UNIX (including Mac OS X), it consists of nessusd, the Nessus daemon, which does the scanning, and nessus, the client, which controls scans and presents the vulnerability results to the user. For Windows, Nessus 3 installs as an executable and has a self-contained scanning, reporting and management system.

I have personaly used this tool conjucntion with other tools in the past to check and audit my own servers for security flaws, before I moved it to production, I would say Intallation of this tool in any platform is simple and easy, the user interface is great and self explanatory, the produced report is easy to read and understand and can be presented immediately without edit, in my opinion this is one of the best and just because its free it probably is the best out there.



No comments:

For suggestion and concerns E-mail