Nessus Vulnerability Management Lab

Overview

In this project, I set up a vulnerability management lab using Nessus Essentials, VMware Workstation Player, and a Windows 10 virtual machine.

The main goal was to see the difference between an uncredentialed scan and a credentialed scan. I also installed an outdated version of Firefox to see how vulnerable software affected the scan results. After that, I removed the software, updated Windows, and scanned the machine again to see whether the vulnerabilities decreased.

What I Used

Tool	How I Used It
Nessus Essentials	Scanned the Windows virtual machine for vulnerabilities
VMware Workstation Player	Created and ran the virtual machine
Windows 10	Used as the target system
Command Prompt	Found the VM's IP address and tested connectivity
Windows Registry Editor	Changed a setting needed for credentialed scanning
Windows Update	Installed updates during remediation

Lab Setup

flowchart LR
    A[Windows Host Computer] --> B[Nessus Essentials]
    A --> C[VMware Workstation Player]
    C --> D[Windows 10 Virtual Machine]
    B -->|Scans| D
    D -->|Scan Results| B

Loading

Nessus was installed on my main computer, while the Windows 10 virtual machine was used as the scan target.

I configured the virtual machine to use bridged networking so that it could communicate with the host computer over the same network.

Project Process

flowchart TD
    A[Create Windows 10 VM] --> B[Test Network Connection]
    B --> C[Run Uncredentialed Scan]
    C --> D[Configure Credentialed Scanning]
    D --> E[Run Credentialed Scan]
    E --> F[Install Outdated Firefox]
    F --> G[Run Another Scan]
    G --> H[Review Vulnerabilities]
    H --> I[Remove Firefox and Update Windows]
    I --> J[Run Final Scan]
    J --> K[Compare Results]

Loading

1. Creating the Virtual Machine

I created a Windows 10 virtual machine in VMware Workstation Player.

During the setup, I gave the VM enough storage and memory to run Windows and changed the network adapter to bridged mode. This allowed the VM to connect to the same network as the computer running Nessus.

2. Testing the Connection

Inside the virtual machine, I opened Command Prompt and used:

ipconfig

This showed the IPv4 address assigned to the VM.

I then tested the connection from my host computer using:

ping <VM-IP-ADDRESS>

At first, the ping was blocked by the Windows firewall. I temporarily changed the firewall settings inside the lab VM so that the host computer could reach it.

These firewall changes were only made for the isolated lab environment. I would not disable these protections on a normal or production computer.

3. Running the First Nessus Scan

I created a Basic Network Scan in Nessus and entered the IP address of the Windows virtual machine as the target.

The first scan was uncredentialed, meaning Nessus did not have a Windows username and password for the target.

Because of that, the scan mostly showed information that Nessus could detect from outside the machine. It had limited access to the operating system, installed programs, registry, and services.

4. Setting Up Credentialed Scanning

Next, I configured the Windows VM so that Nessus could perform a credentialed scan.

I completed the following steps:

• Started the Remote Registry service
• Enabled Network Discovery
• Enabled File and Printer Sharing
• Adjusted User Account Control inside the test VM
• Added the LocalAccountTokenFilterPolicy registry value
• Added the Windows test account credentials to Nessus

These changes allowed Nessus to inspect more information inside the operating system.

5. Running the Credentialed Scan

I ran the scan again after adding the Windows credentials.

The credentialed scan found more vulnerabilities than the original scan because Nessus could now check installed software, system settings, services, updates, and registry information.

This showed me why credentialed scans are more useful when an organization wants a more complete view of a computer's vulnerabilities.

6. Installing Outdated Software

To create a more vulnerable system, I installed an outdated version of Firefox inside the virtual machine.

I then ran another credentialed Nessus scan.

The outdated browser caused a large increase in the number of vulnerabilities found. This showed how one unsupported or unpatched application can add many security issues to a system.

7. Reviewing the Findings

After each scan, I reviewed the results inside Nessus.

I looked at:

• Critical, high, medium, and informational findings
• Credentialed scan status
• Vulnerability descriptions
• Recommended fixes
• Scan history
• Findings connected to Firefox
• Windows and Microsoft application updates

I also compared the scans to see how the results changed at each stage of the project.

8. Remediation

To reduce the vulnerabilities, I:

1. Uninstalled the outdated version of Firefox
2. Ran Windows Update
3. Restarted the virtual machine when needed
4. Checked for updates again
5. Repeated the process until the available updates were installed
6. Ran another Nessus scan

9. Final Scan

The final credentialed scan showed fewer critical and high-severity vulnerabilities after Firefox was removed and Windows was updated.

Some findings were still present because certain Windows or Microsoft applications needed additional updates.

The final scan was important because it confirmed that the remediation steps actually reduced the system's exposure.

Scan Comparison

Scan	Type	System Condition	Result
First scan	Uncredentialed	Default Windows installation	Limited results
Second scan	Credentialed	Default Windows installation	More vulnerabilities found
Third scan	Credentialed	Outdated Firefox installed	Large increase in vulnerabilities
Final scan	Credentialed	Firefox removed and Windows updated	Critical and high findings decreased

What I Learned

This project helped me understand that vulnerability management is more than running a scanner once.

A complete process includes:

• Finding vulnerabilities
• Reviewing and prioritizing the findings
• Fixing the issues
• Scanning again to confirm the fixes worked
• Repeating the process over time

I also learned that credentialed scans can provide much more useful information than scans performed without credentials.

Another major takeaway was how much risk can come from one outdated application. Updating or removing vulnerable software can fix many related findings at once.

Skills Practiced

• Nessus vulnerability scanning
• Credentialed and uncredentialed scans
• Windows administration
• Virtual machine setup
• Basic network troubleshooting
• Windows Registry changes
• Patch management
• Vulnerability remediation
• Scan result comparison
• Technical documentation

Project Notes

I completed this lab before creating the GitHub repository, so I did not keep all of the original screenshots, Nessus exports, or exact scan totals.

Because of that, I documented the process and overall results without presenting numbers from the tutorial as if they were my own.

In the future, I plan to repeat the lab and save screenshots and sanitized scan exports from each stage.

Security Notes

This lab was completed in a test virtual machine.

Some settings were temporarily weakened to allow credentialed scanning. Those settings should not be copied directly to a production computer without understanding the risks and having other security controls in place.

No passwords, activation codes, credentials, or personal network information are included in this repository.

Attribution

I completed this project by following a publicly available vulnerability management lab tutorial.

I personally set up the virtual machine, configured Nessus, ran the scans, installed the outdated software, completed the remediation steps, reviewed the results, and created this repository to document what I did and learned.

Credit

I completed this lab by following Josh Madakor's vulnerability management lab video.

The video provided the main setup and process for the lab. I followed the tutorial to create the virtual machine, configure Nessus, run and compare the scans, install outdated software, and complete the remediation steps.

This repository documents my own completion of the lab and what I learned from it.