October 20, 2026

Vulnerability Management Lab: From System Readiness to Nessus Scanning

How I built a virtual cybersecurity lab with VirtualBox, Kali Linux, Metasploitable 2, and Nessus Essentials.

By Ibeoezinne

3 min read

When I began my Risk and Vulnerability Assessment project, I thought the process would be straightforward: install a security tool, run a scan, identify vulnerabilities, and document the results. However, I quickly discovered that vulnerability management involves much more than running a security tool.

Before performing my first scan, I needed to check whether my laptop could handle the lab environment, install the necessary software, configure virtual machines, establish network connectivity, and troubleshoot technical challenges.

This project became an opportunity to learn by doing.

I used a fictional Nigerian microfinance bank, PayLink MFB, as the business case study, while the technical assessment was conducted against Metasploitable 2, an intentionally vulnerable virtual machine.

Checking My Laptop's Capability

My first task was to determine whether my laptop had sufficient resources to run the lab.

My system specifications were:

  • Operating System: Windows 11, 64-bit
  • Laptop: ASUS VivoBook X509DAP/M509DA
  • Processor: AMD Ryzen 3 3250U
  • RAM: 8GB
  • Virtualization: Enabled
  • Approximately 52.6 GB of free disk space after cleanup

How I checked my system

Check the Windows version

  1. Press Windows + R.
  2. Type winver.
  3. Press Enter.
  4. Confirm the Windows version.

Check RAM and processor

  1. Press Ctrl + Shift + Esc.
  2. Open Task Manager.
  3. Select Performance.
  4. Check Memory and CPU.

Check virtualization

  1. Open Task Manager.
  2. Select Performance → CPU.
  3. Look for the Virtualization status.

Check available storage

  1. Open File Explorer.
  2. Select This PC.
  3. Check the available space on the C: drive.

Installing VirtualBox

  1. Visit https://www.virtualbox.org/
  2. Download the Windows host installer.
  3. Install VirtualBox.
  4. Install the matching Extension Pack where needed.
  5. Open VirtualBox and verify that it launches successfully.

I prepared three virtual machines:

  • Kali Linux: For network discovery and security testing.
  • Metasploitable 2: For vulnerability scanning and practical testing.
  • Debian Linux: For installing Nessus Essentials.

Because my laptop had only 8 GB of RAM, I had to manage resources carefully.

Set Up Kali Linux

Setup process

  1. Download the prebuilt VirtualBox image from the official Kali website: https://www.kali.org/get-kali/
  2. Import or open the downloaded virtual machine according to the supplied image format.
  3. Allocate approximately 2 GB of RAM and 2 virtual CPUs.
  4. Configure the first network adapter as NAT.
  5. Configure a second adapter as Host-Only.
  6. Start Kali Linux and log in.
  7. Update the system.

Commands used:

sudo apt update
sudo apt full-upgrade -y

After updating, I restarted the virtual machine and the Host-Only adapter received the address 192.168.56.102/24.

Set Up Metasploitable 2

Setup process

  1. Download Metasploitable 2 from its official Rapid7/SourceForge distribution.
  2. Extract the downloaded archive.
  3. In VirtualBox, create or add a virtual machine using the existing Metasploitable.vmdk disk.
  4. Select an appropriate 32-bit Linux operating system type.
  5. Allocate 512 MB of RAM and one virtual CPU.
  6. Configure Adapter 1 as Host-Only.
  7. Disable the second adapter.
  8. Start the machine.

The default laboratory login was:

Username: msfadmin
Password: msfadmin

After logging in, I checked the network configuration using:

ifconfig

The machine received the Host-Only IP address 192.168.56.101/24.

The virtual machine initially failed to start because of a VirtualBox Host-Only networking error:

VERR_INTNET_FLT_IF_NOT_FOUND

I checked the network adapter configuration and restarted Windows before trying again. The machine subsequently booted successfully.

Install Nessus Essentials on Debian

Debian setup

  1. Download the official Debian installation ISO from https://www.debian.org/distrib/.
  2. Create a Debian virtual machine in VirtualBox.
  3. Allocate 4 GB of RAM, two virtual CPUs, and a 30 GB virtual disk.
  4. Install Debian and create a regular administrative user.
  5. Configure Adapter 1 as NAT and Adapter 2 as Host-Only.
  6. Confirm that the Host-Only interface can reach Metasploitable 2.

Install Nessus

  1. Visit https://www.tenable.com/downloads/nessus.
  2. Download the appropriate Nessus Debian package.
  3. Transfer the package to the Debian VM.
  4. Open a terminal in the directory containing the package.
  5. Install it using:
sudo dpkg -i Nessus-10.12.4-debian10_amd64.deb
  1. Start and verify the service:
sudo systemctl enable --now nessusd
sudo systemctl status nessusd
  1. Open Nessus from the Windows host using:

https://192.168.56.103:8834

  1. Complete the Nessus Essentials registration and activation process.

  2. Wait for the plugins to download and compile.

Challenge encountered

Windows initially could not reach Nessus because the Host-Only network addresses were inconsistent. I corrected the VirtualBox Host-Only network configuration and verified connectivity to TCP port 8834.

The Debian Host-Only interface also needed to be brought up after rebooting.

Perform Nmap Service Enumeration

Before running Nessus, I used Nmap to identify open ports, running services, and service versions on the target.

From Kali Linux, I ran:

nmap -sV 192.168.56.101

The -sV option enables service-version detection.

The scan identified services including FTP, SSH, Telnet, SMTP, HTTP, Samba, MySQL, VNC, X11, and NFS.

I saved the results to:

metasploitable-services.txt

This output provided an initial understanding of the target's exposed services.

Perform the Nessus Vulnerability Scan

After confirming network connectivity, I performed a vulnerability scan against the authorized Metasploitable 2 target.

Scan process

  1. Open the Nessus web interface.
  2. Confirm that the scanner and plugins are ready.
  3. Run a Host Discovery scan against 192.168.56.101.
  4. Confirm that the target is discovered.
  5. Open the host results.
  6. Choose the option to create a scan.
  7. Select Basic Network Scan.
  8. Enter 192.168.56.101 as the target.
  9. Save and launch the scan.
  10. Wait for the scan to finish.
  11. Review the vulnerability findings and severity levels.

The completed scan displayed 68 vulnerability records.

The host results showed Auth: Fail, indicating that authentication had not succeeded for the relevant authenticated checks. Therefore, I treated the results as an unauthenticated or limited assessment rather than claiming that all checks had been performed with system credentials.

10. Step Nine: Analyze the Findings

Ten representative findings were selected for detailed analysis.

Examples included:

  • Ubuntu 8.04 End-of-Life
  • VNC server accepting the password password
  • SSL 2.0/3.0 enabled
  • Samba Badlock vulnerability (CVE-2016–2118)
  • rlogin service exposure
  • World-readable NFS share
  • TLS 1.0 enabled
  • Unencrypted Telnet
  • X Server exposure
  • ICMP timestamp information disclosure

I examined each finding's description, severity, available CVE reference, potential impact, and recommended solution.

Not every finding had a CVE. Where Nessus did not provide an applicable CVE and no relevant reference was identified, I recorded the CVE as N/A instead of inventing one.