8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)

Objective 3.1 also lists tools. This chapter covers the three core vulnerability scanners: Nikto, Greenbone / Open Vulnerability Assessment Scanner (OpenVAS), and Tenable Nessus. They are not interchangeable. Exam items mix a subnet missing-patch story with a "dangerous files on Apache" story and wait for you to grab the wrong logo.

Tenable Nessus

Tenable Nessus is a commercial, plugin-based vulnerability-assessment platform. Plugins (historically NASL, the Nessus Attack Scripting Language) encode checks: banner matches, missing Microsoft KBs, weak cipher suites, default community strings, compliance audits. Nessus can run unauthenticated (outsider path) or authenticated (Windows, SSH, SNMP, database, or API credentials). That is why the worked /24 in section 8.1 used Nessus both ways.

Return to 10.0.0.0/24 and 10.0.0.14. Unauthenticated Nessus reports the Apache 2.4.x banner CVE on TCP 80. Authenticated Nessus, with a domain account, adds the missing security KB and the local service running as SYSTEM. Same tool, different mode, different inventory. Nessus is the match when the stem wants a full-network or credentialed-host vulnerability assessment, compliance plugins, or a commercial scanner with an extensive feed.

Nessus is not automatically safe on ICS, as the previous section said. Default plugin sets assume IT hosts. On a plant VLAN, "we have Nessus" is not a license to enable every check. On ordinary Windows and Linux IT, credentialed Nessus is how testers close the gap between banners and local truth.

Greenbone / OpenVAS

OpenVAS is the Open Vulnerability Assessment Scanner. CompTIA writes it with Greenbone, the project and product family that maintains the scanner inside Greenbone Vulnerability Management (GVM). Treat Greenbone/OpenVAS as the open-source analog of Nessus for exam purposes: plugin-based network and host vulnerability assessment, unauthenticated and authenticated checks, CIDR targets, and a feed of network-service and missing-patch tests.

When the client wants the same class of scan as Nessus but an open-source stack, Greenbone/OpenVAS is the 3.1 answer. It is not "Nessus but UDP-only." It is not a web-only CGI fuzzer. It will not replace Nikto's dedicated dangerous-file checks as the best named tool for a single HTTP misconfiguration hunt, but it is a network vulnerability platform, which Nikto is not.

Exam trap: claiming OpenVAS cannot do authenticated scans, or claiming Greenbone is a wireless cracking suite. Another trap: picking BloodHound or PowerSploit as the open-source Nessus. Those are specialized discovery and Windows post-exploitation-adjacent tools for the next chapter, not GVM.

Nikto: web server checks, not a full network platform

Nikto is a web-server scanner. It sends HTTP requests looking for outdated server software, default files and scripts, dangerous paths (the classic /server-status, leftover installer pages, known CGI), and misconfiguration clues in headers. Point it at http://10.0.0.14/ after the unauthenticated Nessus pass and you may learn that directory listing is on, that a sample script still answers, or that the Server header is years behind.

Nikto does not enumerate missing Windows KBs. It does not authenticate to SMB and read the patch database. It does not replace Greenbone on a /24 of mixed Windows, Linux, and SNMP devices. If the stem says "network vulnerability assessment of the subnet," Nikto is the distractor. If the stem says "dangerous files and outdated banners on the HTTP host," Nikto is the tool CompTIA listed for that job.

Nikto is also noisy and obvious in logs. That is a discovery tradeoff, not an exploit. You still stay inside the URL and host named in the statement of work. You do not follow a CDN origin out of scope because Nikto printed an interesting path.

Worked selection: one host, three tools

On 10.0.0.14 you might reasonably run all three, for different questions:

1. Unauthenticated Nessus or OpenVAS across 10.0.0.0/24 — outsider CVEs, including the Apache banner.
2. Authenticated Nessus or OpenVAS on .14 — missing KB, local SYSTEM service.
3. Nikto against TCP 80 or 443 on .14 — web-server files and headers that a generic plugin pass may only hint at.

You would not use Nikto as the only scanner for the subnet, and you would not use Nessus default plugins as the ICS method on a PLC VLAN. Tool choice is part of 3.1, the same way scan type is.

free PT0-003 practice questionsPractice questions with detailed explanations

Remember the three exam sentences. Nessus is Tenable's plugin platform, including authenticated missing-KB checks. OpenVAS is Greenbone's open-source scanner in the same class. Nikto checks web servers and is not a full network vulnerability platform. If you can assign those sentences under time pressure, you have this chapter's tool list.