July 23, 2026
Nessus | TryHackMe
Learn how to set up and use Nessus, a popular vulnerability scanner.
By Nuray Xudadatova
6 min read
Room Link
PS: As Nessus doesn't work on my device, I found the answers to the questions using other methods instead of Nessus.
Task 1 →Introduction
Nessus vulnerability scanner is exactly what you think is its! A vulnerability scanner!
It uses techniques similar to Nmap to find and report vulnerabilities, which are then, presented in a nice GUI for us to look at.
Nessus is different from other scanners as it doesn't make assumptions when scanning,
like assuming the web application is running on port 80 for instance.
Nessus offers a free and paid service, in which some features are left out from the free to make you more inclined to buy the paid service.
Their pricing is similar to Burp Suite, so unless you got some spare change, we will be just be using their free version.
You can check out their pricing options here: https://www.tenable.com/products/nessus(opens in new tab)(opens in new tab)
Answer the questions below
I have read the description!
No answer needed
Task 2 → Installation
We will be installing Nessus on a Local Kali VM.
Warning: Do not install Nessus on the THM AttackBox. It will not work, as there's no sufficient space!
Other OS's will not be covered in this walkthrough, in which case the official installation guide can be found below.
https://docs.tenable.com/nessus/Content/GettingStarted.htm(opens in new tab)
Answer the questions below
Step #1
Goto https://www.tenable.com/products/nessus/nessus-essentials (opens in new tab) and register an account.
You will need to do this for an activation code.
No answer needed
Step #2
We will then download the Nessus-#.##.#-debian6_**amd64.**deb file
Save it to your /Downloads/ folder
No answer needed
Step #3
In the terminal we will navigate to that folder and run the following command:
sudo dpkg -i package_file.deb
Remember to replace package_file.deb with the file name you downloaded.
No answer needed
Step #4
We will now start the Nessus Service with the command:
sudo /bin/systemctl start nessusd.service
No answer needed
Open up Firefox and goto the following URL:
https://localhost:8834/ (opens in new tab)
You may be prompted with a security risk alert.
Click Advanced… -> Accept the Risk and Continue
No answer needed
Step #6
Next, we will set up the scanner.
Select the option Nessus Essentials
Clicking the Skip button will bring us to a page, which we will input that code we got in the email from Nessus.
No answer needed
Step #7
Fill out the Username and Password fields. Make sure to use a strong password!
No answer needed
Step #8
Nessus will now install the plugins required for it to function.
This will take some time, which will depend on your internet connection and the hardware attached to your VM.
If the progress bar appears to be not moving, it means you do not have enough space on the VM to install.
No answer needed
Step #9
Log in with the account credentials you made earlier.
No answer needed
Step #10
You have now successfully installed Nessus!
No answer needed
Task 3 →Navigation and Scans
Navigation and Scan Types!
Answer the questions below
Question: What is the name of the button which is used to launch a scan?
Answer: New Scan
Question: What side menu option allows us to create custom templates?
Answer: Policies
Question: What menu allows us to change plugin properties such as hiding them or changing their severity?
Answer: Plugin Rules
Question: In the 'Scan Templates' section after clicking on 'New Scan', what scan allows us to see simply what hosts are alive?
Answer: Host Discovery
Question: One of the most useful scan types, which is considered to be 'suitable for any host'?
Answer: Basic Network Scan
Question: What scan allows you to 'Authenticate to hosts and enumerate missing updates'?
Answer: Credentialed Patch Audit
Question: What scan is specifically used for scanning Web Applications?
Answer: Web Application Tests
Task 4 → Scanning!
Run a Network Scan!
Answer the questions below
Question: Create a new 'Basic Network Scan' targeting the deployed VM. What option can we set under 'BASIC' (on the left) to set a time for this scan to run? This can be very useful when network congestion is an issue.
Answer: Schedule
Question: Under 'DISCOVERY' (on the left) set the 'Scan Type' to cover ports 1–65535. What is this type called?
Answer: Port scan (all ports)
Question: What 'Scan Type' can we change to under 'ADVANCED' for lower bandwidth connection?
Answer: Scan low bandwidth links
With these options set, launch the scan.
No answer needed
Question: After the scan completes, which 'Vulnerability' in the 'Port scanners' family can we view the details of to see the open ports on this host?
Answer: Nessus SYN scanner
Question: What Apache HTTP Server Version is reported by Nessus?
Answer: 2.4.41
Task 5 → Scanning a Web Application!
Run a Web Application scan on the VM!
(Running this Scan will take some time to complete, please be patient)
Answer the questions below
Question: What is the plugin id of the plugin that determines the HTTP server type and version?
Answer: 10107
I just searched it on Google:
Question: What authentication page is discovered by the scanner that transmits credentials in cleartext?
Answer: login.php
Question: What is the file extension of the config backup?
Answer: .bak
gobuster dir -u http://<lab_machine_ip_addres>/config/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-files.txt -x bak,old,zip
PS: if you don't have seclists installed on your device, first you should install it: sudo apt install seclists
Since config.inc.php.bak returned a 200 status code, this confirms that the file exists and is accessible on the server. Therefore, we know the extension of the config backup file is .bak
Question: Which directory contains example documents? (This will be in a php directory)
Answer: /external/phpids/0.6/docs/examples/
curl http://10.114.160.82/external/phpids/0.6/docs/
Question: What vulnerability is this application susceptible to that is associated with X-Frame-Options?
Answer: Clickjacking
In the header list, X-Frame-Options is completely missing (Server, Set-Cookie, and Content-Type are present, but this header is not).
This means the application isn't giving the browser any instruction telling it 'don't display this page inside an iframe.' As a result, an attacker could secretly embed this login page inside an <iframe> on their own website and trick the user into clicking (for example, using a transparent overlay) — this is exactly a Clickjacking attack.