I followed the TryHackMe/Nessus walkthrough and wrote up a compact playbook for folks new to Nessus. Short version up-front, then steps + real lab findings and tips.
Install Nessus Essentials, start the service, run a Basic Network Scan (1–65535) and a Web App Test to get fast results. In the TryHackMe lab Nessus flagged backup file disclosure, directory listing, clickjacking and clear-text credentials , all high-impact stuff to fix.
Why Nessus?
It’s built to find vulns precisely (won’t assume a web app lives on port 80 if it’s not there). Good GUI, many scan templates (host discovery, credentialed audits, web app tests). Useful for labs and real assessments when you have permission.
Post-scan notes
-
Don’t assume remote access , e.g., DB creds in the backup file may be valid only locally (I confirmed the MySQL port 3306 was closed via
nmap). Always verify service accessibility. -
Use credentialed scans (Credentialed Patch Audit) where possible , they find missing patches/config issues that unauthenticated scans can miss.
Full writeup from here
0 comments