Using Nmap Results With Nessus Batch Scanning

A Nessus user recently asked us the following question:

"I would like to have Nessus read Nmap scan results from the command line. I already have Nmap portscanning and operating system fingerprinting, can I import the Nmap findings using Nessus in batch mode?"

Tenable has supported Nmap usage within Nessus for several years. Nmap and Nessus have different types of scanning philosophies and understanding how they work can help you achieve success with your network scanning efforts. The Nessus server includes its own portscanning, service fingerprinting and operating system identification techniques that are similar but independent from Nmap’s. However, you may run into a situation where Nmap was run first and you already have the output from this tool and want to apply the results to your vulnerability scan. I set out to do this in my lab and realized this would be a good opportunity to highlight some of the features in Nessus. Below is a step-by-step guide on configuring Nessus to run batch mode scans based on Nmap results:

Step 1 - Run Nmap and output “grepable” results:

The Nmap command above will scan the target network (192.168.1.0/24), identify the remote operating system (-O), detect the services running on the ports discovered (-sV), and output Nmap grepable results (-oG) into the file called "nmapscanresults" using aggressive scan speeds (-T4).

Step 2 - Now we can use NessusClient to configure a Nessus scan that will use the Nmap results. You could create the Nessus configuration without using the NessusClient by creating a ~/.nessusrc file containing the scan policy information. However, its easier to perform the initial configuration and vulnerability scan using the NessusClient, then make subsequent changes in the ~/.nessusrc file. Refer to "When, how and why (not) to use Nmap within Nessus" for instructions on how to setup and configure nmap.nasl and make sure you are using the latest version of nmap.nasl. When you configure the policy, do not check the “share policy across multiple sessions” box. If you do, the scan policy will not be embedded into the .nessus file.

Step 3 - Only enable the Nmap Importer NASL wrapper in your scan policy configuration:

Since the Nmap output file contains all of the portscan results for our targets we do not need to enable any additional portscanners.

Step 4 - Go to the Advanced tab and select "Nmap Importer (Nasl wrapper)" from the pull-down menu. This option allows you to choose the Nmap grepable results file to use for the scan:

Step 5 - Execute your scan against the targets of your choosing (these too will be stored in the .nessus file) and save the results by choosing "File-Save As.." from the menu. This will save both the scan results and scan policy into the same .nessus file. In this example we called the file "ExampleNmap.nessus" and transfer it to the Nessus server.

Step 6 - Read our scan policy and results with the Nessus client. A Mac OS X system was used in this example. If you are using a Linux system, note that the path to Nessus will be /opt/nessus/bin/nessus:

Step 7 - Execute your scan in batch mode using the following command:

The above command will connect the command-line Nessus client to the local nessus server. A scan will be executed using the policy name "ExampleNmap" which exists in the "ExampleNmap.nessus" file. The results will be stored in the .nessus file.

Step 8 - When the scan has completed you can export and review the results using the following commands:

The above command shows two reports inside the .nessus file, listed by the time and date they were completed. Use the following command to export the most recent results to HTML:

Conclusion

If you have previously scanned your network with Nmap and saved the results in grepable Nmap output, you can save the step of having Nessus rescan your network by importing the results into Nessus and incorporating them into your scan. The Nessus command line client ("nessus") can import results and scan polices from a .nessus file. Large organizations who have dedicated port scanning monitoring efforts should also consider deploying the Passive Vulnerability Scanner with the Security Center. This allows continuous monitoring of the network for change in real time and automatically combines passively discovered information with results from Nessus active and credentialed network scans.