Network Scanning Cookbook: Practical network security using Nmap and Nessus 7

Imagine you're standing at the edge of this huge, complex digital landscape. Maybe you're a network admin, maybe just really curious about how it all works underneath, right, and suddenly you're just hit with this flood of info about network security vulnerabilities, exploits, all these scanning tools. It's overwhelming. How do you actually cut through that noise? How do you get smart about what really matters without you drowning?

Well, that's exactly what we try to do here on the deep Dive. We're aiming to be that shortcut for you. We dig through a whole stack of sources on these really complex topics and pull out the most important insights, sort of turning that information overload into hopefully clear understanding.

And today we're diving into the Network Scanning Cookbook. This isn't just theory, right, it's a really practical look at how two absolute powerhouse tools en MAP and NESSUS are used to genuinely understand network security exactly.

We'll get to the essentials. What are these tools, why are they so crucial for dealing with today's digital threats, and how they can uncover some surprising weaknesses even in places you might not expect, like say, industrial control systems.

Okay, so by the end of this deep dive, the idea is you'll not only get the core concepts, but you'll have those aha moments. You'll be able to really evaluate network security stuff critically.

Let's get started right, Well, like any good cookbook, you start with the basics and a network security that's defining a vulnerability. Fundamentally, it's just a weakness, a flaw in a system or a device that an attacker could potentially exploit. Think of it like a door left unlocked, maybe a window latch that's broken.

Got it, simple weakness. So network vulnerability scanning, that's basically the process of actively hunting for those weak spots across your whole network.

That's it, clients, servers, routers, switches, everything connected.

And with new critical vulnerabilities popping up seeming well daily, what's this so urgent for organizations? Why make it a real time thing?

It's really about staying ahead of the curve. Organizations absolutely need procedures in place, real time procedures to find, analyze, and fix these issues before attackers find them.

Right prevention exactly.

It prevents potentially huge financial losses, protects their reputation, keeps systems updated, and crucially, you can't fix everything instantly, so it's also about smartly prioritizing which risks are the biggest threats.

That's the classic problem, isn't it. You hear stories all the time where some major flaw goes unfixed for ages just because they didn't prioritize it correctly.

It happens way too often.

Now. The sources talk about two main kinds of scans. Can you break those down?

Sure? So? First you have internal scans. These simulate what an insider could see, usually targeting private IP addresses inside the company network. Then you have external scans. These mimic an attacker coming from the Internet hitting your public facing IP addresses.

Ah so inside and outside views.

Precisely, and you absolutely need both for a complete security picture. It's like checking your house locks from the inside and walking around the outside to check the windows.

Makes sense, and the scanning itself, it follows a pretty logical flow, right, like a three step recipe exactly.

The first phase is discovery sometimes called host discovery. Okay, you got to find out what's actually live on the network first, no point scanning things that aren't even turned on or don't.

Exist, right, avoid wasted effort exactly.

Tools like end map and nessus are great for this. N MAP even has its script engine, the NSC, for really customized discovery.

Okay, so step one find the live devices. What's next?

Step two is port scanning. Once you know what's live, you need to check which doors, which ports are open on those devices, and it works differently depending on the protocol like TCP versus UDP. En map is really the master tool for figuring all that.

Out, checking the doors and windows on the live houses. Got it?

And the final step, the final, really crucial phase, is vulnerability scanning. This is where automated tools, especially nessa's, really come into their own how so well, They go beyond just seeing if a port is open. They actually try to look through that open port to find known issues, things like outdated software, vulnerable protocols, maybe even default admin passwords left unchanged.

Ah.

Imagine trying to manually check for thousands of known vulnerabilities across one hundred, maybe thousands of devices almost impossible.

Yeah, you'd never finish. So Okay, the scan runs what kind of valuable stuff? What are those gold nuggets? It actually finds what are the key takeaways?

Oh? It's like finding a treasure map to your network's weaknesses. It reveals things like unwanted open port stores that shouldn't be opened at all.

Okay.

It can find default user accounts basically engraved invitations for attackers, missing security patches, massive holes, vulnerable software protocols. Sometimes it even gives you direct information on how to exploit a vulnerability. It's an instant in blueprint of you'rre hidden risks.

But real world networks they're messy, aren't they? Firewalls, weird configurations. The sources mentioned This complexity can lead to false positives. What is that exactly?

Yeah, that's a really important point. A false positive is when the scanner reports of vulnerability or maybe says a host is live, but it's actually wrong. For example, a firewall might just block the scanner's ping, making a machine look offline when it's perfectly fine. Understanding these is key because chasing down non existent problems waste a ton of time.

Right, you focus your effort on the real issues. So, like any good recipe, you need good prep for the scan. What are the key things to get right beforehand?

Three main things? Really. First, you absolutely have to define the scan scope know exactly what you are and aren't scanning, and why don't just point it everywhere?

Okay?

Scope?

Second, understand the network architecture. Got a web application firewall? You need to know how that affects.

The scan right, know the landscape. And third, make sure the scanner has proper network access. Sometimes you need to whitelist its IP address so firewalls don't block its scans. You need to clear the path for it.

Okay, scope, architecture access, got it. But finding the vulnerabilities that's just step one. Right. Once you have this list of problems, what's next? How do you actually improve security?

That's why the response and mitigation plan kicks in. It's all about fixing what you found, closing those unwanted ports, enforcing strong passwords, unique ones, applying the patches you miss, maybe disabling old, risky protocols, and crucially remembering network security isn't a one off task. It's a continuous cycle. Assess, analyze, mitigate, then repeat. You're never really.

Done right, always iterating. Okay, let's get into the tools themselves. First up in the cookbook NESSUS.

RIGHTSUS, it's a very comprehensive commercial grade vulnerability scanner. Its real strength comes from its constantly updated plug in billion. Yeah, they're basically little detection scripts. They're written in a language called NASL Nessus Attacks Scripting Language. These plugins let nessus find new vulnerabilities incredibly quickly, often as soon as they become public.

Wow.

Plus, it has a nice user friendly web interfhase a GUI, which makes setting up and running scans, even complex ones, pretty straightforward.

So it sounds powerful, but how do security teams actually use it day to day? What are the practical features that make it efficient?

Missus has several really useful operational features. For example, policies. A policy is like a template, a collection of settings and scan types you've configured. Ok, you create a policy once, say for scanning Windows servers, and then you can reuse it for dozens or hundreds of scans. There's a huge amount of time I can see that. Then there are

And what about the basic nessis settings security configuration.

Yeah, it's built with that in mind. You can set a master password to enquip sensitive things like stored credentials. You can gifigure proxy servers if NESSAS needs to go through under reach the internet or scan targets. Okay, you can set up SMTP so it automatically emails you when scans are done, and there's robust password management to secure the NESSUS console itself. It's pretty why I thought out.

Okay, NESSUS covered, Let's switch to the other big name, end map. What makes nmap the Swiss army knife. Everyone calls it.

Endmap is well tree, It's open source, and it's incredibly versatile. It's primarily a command line tool. Its main job is to help you map out a network, figure out what hosts are up, what ports are open on those hosts, and what services are running. It gives you a detailed picture of your network's posture and.

Vers It all seems like an understatement. The options look almost endless. You can be really precise or sneaky.

That's a good way to put it. Take host discovery. N MAP can find live systems even if they block standard pings. It uses cleverer probes like syn pings, devil M pants or azkpings civil p that often slip past firewalls that just look for normal ICMP.

Pings sneaky indeed, and the scanning.

Itself huge variety and scan techniques. You can choose based on speed and stealth. There's the tcpsyn scan SSS. They have open scan, which is fast and quiet because it doesn't complete the connection, or the full TCP connect scan dash ST which is more reliable but noisier, and it handles other protocols too, like UDP scans dashes you which are important because attackers use UDP too, and you.

Can tell it exactly which ports to check.

Absolutely for ports specification by default, and map scans the top one thousand most common ports, which is usually a good start, but you can tell it to scan a specific range like dash EP one sixty five five three five for every single port, although that takes time, or you can do a fast scan dashes F for just the top one hundred ports.

Super flexible and it doesn't just find open ports, does it. It tells you what's running. It's exactly its service and OS detection is fantastic. Use the NSSV flag and n MAP will try to determine the exact application and version running on a port. Use NSO and it'll try to guess the operating system of the target machine. Really valuable intel.

Okay, but here's where NMP gets really interesting. According to the sources, evasion and spoofing sounds like spycraft.

It kind of is. This is where a skilled end MAP user can try to bypass network defenses like firewalls or intrusion detection systems. Techniques like packet fragmentation. This breaks the probe packets into tiny pieces. Some older firewalls struggle to reassemble and inspect these fragments properly.

Clever.

Or you can use decoy addresses digit D. This makes the scan look like it's coming from multiple IP addresses, simultaneously, helping to hide your real source IP among the noise. You can even spoof your MSc address spoof if the network has controls based on physical addresses. It's all about being stealthy and making reconnaissance harder to detect or block. So, okay, you run these incredibly detailed scans. You get a ton

And map gives you options. It can just print the results straight to your terminal screen, which is fine for quick scans, yeah, but for saving and analyzing. It has several formats. Normal text dash on en is just a readable text file xml ox is great because other security tools can easily parse and import.

It right for automation exactly.

There's also greepable format dash og, which is designed to be easily searched with command line tools like GP very handy for scripting or quickly finding specific results in large outputs. And if you want all three, just USEA and it says in all formats at once.

Convenient and Nessa's, being more of an enterprise tool, probably has more formal reporting it does.

Nessa's supports are generally more power and aimed at different audiences. You can export in its own NES's format, which is useful for sharing results between different nessas installations. The HTML reports are probably the most common output. They're self contained, highly detailed, easy to navigate, and usually include an executive summarsection, perfect for management who don't need the nitty gritty technical details.

Okay, this feels like a really critical point, maybe the biggest aha moment here confirming vulnerabilities. Why is it so absolutely vital to manually double check what these powerful scanners tell you?

Because bottom line scanners make mistakes, They can and do generate.

False positives, ghost vulnerabilities.

Exactly, You simply cannot afford to waste time and resources fixing problems that don't actually exist. Manually confirming findings is about smart resource allocation. It ensures your team is focused on fixing real, exploitable threats. It's the crucial step that separates automated noise from actionable intelligence.

Let's make this concrete. The sources had some great real world examples. First, a critical risk NESSUS reports a bind shell back door.

Right, so NESSUS flags a specific port, say port one teen twenty four on a machine, reporting it allows roots shell access with no password needed.

That sounds really bad, extremely bad.

So how do you confirm? You could use a simple tool like tell net connect to the IP address one h two point one six eight point one zero three point one two nine on that port one teen twenty four. If you get a prompt, type the command d if it comes back showing wid zero zero zero root. Well, you've just manually confirmed you have root access. It's real critical priority.

Okay, confirmed critical. Next example, a high risk SSL version two and three detected old insecure protocols.

Yeah. NESSUS often flags this because using old SSLTLS versions is risky. So it reports say port twenty five typically smtpmail is using these out data protocols.

Sounds plausible, it does.

But this is where you need to dig deeper. You could use n maps script engine, maybe run the ressoblescript or sln dom ciphers against that specific port.

And what might you find?

This specific case from the source running those end map scripts showed no SSL negotiation at all. The port wasn't using SSLv two or v three. He wasn't using SSL period. It was likely just plain text communication.

Ah, So Nessa's was wrong.

Essentially, yes, it was a false positive. It might have misinterpreted some banner or response. This completely changes the risk picture and highlights why manual verification is non negotiable.

That's a fantastic example. Okay, one more medium risk Apache Tomcat default files found.

This one's simpler. Nessa's points out that default documentation or example files are accessible on a Tomcat web server, maybe on port A one eighty. How to check easiest way just open your web browser and go to the url Nessus indicated something like http dot one nine to two point one sixty eight point one zero three point one two nine point eight one eight zero tomcat dot com html. If the default Tomcat documentation page loads up without asking

These examples really show it's not just about running the tool. It's about the analyst using the tool's output as a starting point, then applying critical thinking to confirm what's real and what's not.

Couldn't agree more. The real power isn't just the scanner. It's the combination of the scanner and an informed analyst. And speaking of power, both tools offer great ways to customize them even further, let's talk about an end map script engine NSE. Right.

NSE you mentioned it for a discovery It lets users write their own scripts in LUA. Right, what kind of things can you do with that?

NSESE really extends endmap way beyond basic port scanning. You can write scripts for almost anything network related, more sophisticated host discovery, detecting very specific or unusual services, checking for specific vulnerabilities that maybe aren't in the main databases yet, even performing basic authentication checks, or in some cases safely testing exploits. Wow. These scripts fall into categories like auth discovery, VULN exploit, and writing a basic one isn't super complex.

So, like that Tomcat example, you could write a specific ns script just to check for those default files exactly.

Instead of relying on a broad vulnerability scan, you could have a targeted NSE script that does just that one check very efficiently. It's incredibly powerful for tailoring and MAAP to your specific needs.

And Nessa says customization too, especially around compliance and auditing.

Yes, particularly with its audit policies. These use custom XML based files, often called dot audit files. These files contain rules that compare the actual configuration of a system, say settings in the operating system or an application against a predefined security baseliner.

Standard like CIS benchmarks.

Precisely things like CIS benchmarks, decist eggs, or even hypo requirements. This is essential for white box assessments where you have credentials to log into the system and check its internal configuration thoroughly. You can even write your own custom checks in XML for company specific policies. It moves beyond just network vulnerabilities into configuration hardening and compliance.

Okay, this is all fascinating for standard IT networks, but let's shift focus to something even more critical. Scanning industrial control systems, IoT devices, the operational technology or OT world.

Ah, Yes, OT and ICs. This is where network security gets well potentially kinetic. We're talking about the systems that manage physical industrial processes, power generation, manufacturing lines, water treatment plants, building, automation, and the list goes on. Industrial control systems ICs are the heart of it.

And SCATI fits in here too. Yes.

Scatter supervisory control and data acquisition systems are often used to provide that remote monitoring and control interface for ICs environments. They're designed for high availability keeping processes running.

The risk here seems enormous. A failure isn't just data loss, it could be much worse.

Exactly, A misconfiguration or exploited vulnerability in a SCATA or ICs system could have catastrophic physical consequences and complicating matters. Many of these systems are old. They were designed decades ago, long before cybersecurity was a major concern, so they can be incredibly fragile and full of vulnerabilities.

So can you even use tools like enmap and NESSUS on these systems safely? It sounds risky.

You can, but you have to be extremely careful and knowledgeable. In Map, for instance, has specific NSE scripts designed for common ICs protocols. There's S seven dash info dot NZA for Siemens S seven controllers and Modbus Dash Discover dot NSA for modbus devices. These are widely used. They usually talk on specific ports like TCP Port one oh two for Semens S seven and port five oh two for Modbus. NMAP can identify these systems and ness's nessis also has

That distinction is absolutely vital. Don't break the power plant while trying to secure.

It, please don't. It really underscores that understanding these tools isn't just about corporate IT security anymore. It's about the broader security of our physical infrastructure too.

Right, and once you find these vulnerabilities, other tools might come into play.

Unfortunately, Yes, frameworks like Metasploid also contained modules specifically designed to exploit known SCATA and ICs vulnerabilities. It highlights the urgent need for proactive discovery and careful mitigation in these critical environments.

So we've really taken a deep dive today. We've gone through the practical world of network security scanning, looked closely at ENMP and NESSUS. Hopefully you listening now have a much better grasp of not just what they do, but why they do it, how to read their outputs, and crucially, how to apply that critical thinking to confirm what really matters.

And remember it's not a one and done thing. Network security is absolutely a continuous cycle. Assess analyze, mitigate, and then start again constant vigilance.

So here's a final thought to leave you with. In a world where everything, even our critical industrial systems, is connected and potentially vulnerable, how does really understanding these deep dive scanning techniques empower you not just to protect networks, but to critically evaluate all the security information you encounter and ultimately become a more informed guardian of both our digital and our physical world.