Vulnerability Scanning with Nessus: A TryHackMe Walkthrough (Setup to Web App Scanning)

Introduction

Nessus is one of the most widely used vulnerability scanners in the industry, and knowing how to install, configure, and actually read its output is a foundational skill for any SOC analyst or penetration tester. This write-up documents a full walkthrough of TryHackMe's Nessus room — from connecting to the lab VPN and installing Nessus, through navigating its interface, running a basic network scan, and finally running a dedicated web application scan against a deliberately vulnerable target (DVWA).

Task 1–2: Connecting to the Lab and Installing Nessus

The first step was connecting to the TryHackMe network via the Cloudflare WARP client, then bringing up the OpenVPN tunnel for the room.

First: download Nessus from Tenable's site.

Once installed, Nessus is enabled and started as a systemd service:

sudo systemctl enable nessusd
sudo systemctl start nessusd
sudo systemctl status nessusd

sudo systemctl enable nessusd
sudo systemctl start nessusd
sudo systemctl status nessusd

Now open the browser at https://localhost:8834.

Credentials used:

User: karim
Pass: ******

Welcome to Nessus Essentials. To get started, run a Host Discovery Scan to identify the available hosts on your network to scan. Hosts discovered through a Discovery Scan do not count toward the 16-host limit on your license.

Entering targets:_ targets can be entered as:_

Hostnames
IPv4 addresses
IPv6 addresses

For IP addresses, you can use:

CIDR notation, e.g. 192.168.0.0/24
A range, e.g. 192.168.0.1-192.168.0.255
A comma-separated list, e.g. 192.168.0.0, 192.168.0.1

Q: What is the name of the button which is used to launch a scan?

Q: What side menu option allows us to create custom templates?

Q: What menu allows us to change plugin properties such as hiding them or changing their severity?

Q: In the 'Scan Templates' section after clicking 'New Scan', what scan allows us to see simply what hosts are alive? Q: Which scan type is considered 'suitable for any host'? Q: Which scan allows you to 'Authenticate to hosts and enumerate missing updates'? Q: Which scan is specifically used for scanning Web Applications?

Task 4: Scanning — Running a Basic Network Scan Against DVWA

Now run the target machine (DVWA) and scan it with Nessus.

Q1: Create a new 'Basic Network Scan' targeting the deployed VM. What option can we set under 'BASIC' to schedule this scan to run at a specific time? (Useful when network congestion is an issue.)

Q: Under 'DISCOVERY', set the 'Scan Type' to cover ports 1–65535. What is this type called?

Q: What 'Scan Type' can we change to under 'ADVANCED' for a lower-bandwidth connection?

Notes:_ the Low Bandwidth scan type is good for slow or busy networks because it uses less network traffic and does not put heavy load on the network._

Q: After the scan completes, which 'Vulnerability' in the 'Port scanners' family lets us view the open ports on this host?

Q: What Apache HTTP Server Version is reported by Nessus?

Task 5: Scanning a Web Application

First, run a new scan using the 'Web Application Tests' template against DVWA.

Q: What is the plugin ID of the plugin that determines the HTTP server type and version?

This plugin can be found under Vulnerabilities in: HTTP (Web Servers) → HTTP Server Type and Version.

Q: What authentication page is discovered by the scanner that transmits credentials in cleartext?

This vulnerability can be found under Vulnerabilities: Web Server → Web Server Transmits Cleartext Credentials.

Q: What is the file extension of the config backup?

Found under Vulnerabilities: Backup Files Disclosure.

Q: Which directory contains example documents? (in a PHP directory)

Found under Vulnerabilities: Browsable Web Directories.

Q: What vulnerability is this application susceptible to that is associated with X-Frame-Options?

Found under Vulnerabilities: Web Application Potentially Vulnerable to Clickjacking — the remote web server does not set an X-Frame-Options response header (or a Content-Security-Policy frame-ancestors header), which can expose the site to clickjacking / UI redress attacks.

The "Web Application Potentially Vulnerable to Clickjacking" finding and its full description.

Room Completed

Conclusion

This walkthrough covered the full Nessus workflow end-to-end: getting the scanner installed and running as a service, understanding the Nessus Essentials interface (Scans, Policies, Plugin Rules), configuring scan-level settings that matter in real environments (scheduling to avoid congestion, full port-range discovery, low-bandwidth scanning for busy networks), and finally reading and interpreting real findings from both a Basic Network Scan and a dedicated Web Application scan against DVWA — from server fingerprinting (Apache version, HTTP server plugin) to concrete web vulnerabilities (cleartext credential transmission, exposed backup files, browsable directories, and missing clickjacking protections).

The progression from "what button do I click" to "what does this specific finding mean and where do I find it" reflects the realistic learning curve of getting comfortable with a vulnerability scanner as a working tool rather than just a button to press.

References & Tools

TryHackMe — Nessus room: tryhackme.com/room/rpnessusredux
Tenable Nessus (product page): tenable.com/products/nessus
DVWA (Damn Vulnerable Web Application) — the intentionally vulnerable target scanned in this walkthrough.

This write-up documents a hands-on TryHackMe lab exercise performed as practical security analyst training, covering Nessus installation, configuration, and vulnerability scanning against a DVWA target.