oluwaseunadenuga/Vulnerability-Assessment
Nessus vulnerability scanning lab - credentialed scans and finding analysis
Nessus Essentials Vulnerability Scanning Lab (Kali Linux + Metasploitable 2 Target)
A hands-on home lab vulnerability assessment using Nessus Essentials on Kali Linux, against intentionally vulnerable Metasploitable2.
Covers scan configuration, unauthenticated scanning, findings analysis, false positive investigation, and automated reporting. Built to demonstrate practical VM analyst skills aligned to enterprise vulnerability management operations.
Project Objectives
- Configure and operate Nessus Essentials for vulnerability scanning
- Run unauthenticated scans against Linux and Windows targets in an isolated lab
- Interpret, triage, and document scan findings by severity and exploitability
- Investigate and classify false positives using plugin analysis
- Produce structured remediation tickets for resolver teams
Environment & Scope
- Scanner: Nessus Essentials (cloud-connected)
- Operating System: Kali Linux
- Target: Metasploitable 2 VM (single host)
- Scan Type: Basic Network Scan (unauthenticated)
- In scope: Network-reachable services, open ports, known CVEs, misconfigurations
- Out of scope: Authenticated scans, web application testing, production systems
Methodology
-
Define scope and objectives
Confirmed target IP and restricted scope to the lab VM only.
-
Select and configure scan type
Choose the Basic Network Scan template (most appropriate for initial unauthenticated discovery). -
Run scan and monitor execution
Launched scan → monitored real-time progress in the Nessus dashboard.
- Scan Results Summary
- Prioritise vulnerabilities and prepare a report
Focused remediation effort on Critical → High issues first.
Remediation Handoff & Key Takeaways
- Final deliverable included:
- Recommended remediation steps for critical/high items
These outputs simulate handover to an internal IT/security operations team.
Final Vulnerability Assessment Report.pdf
Key Skills Demonstrated
- Nessus Essentials policy creation & tuning
- Target scoping and constraint definition
- Real-time scan monitoring & result interpretation
- CSV export + spreadsheet-based vulnerability prioritisation
- Risk-based reporting suitable for technical & management audiences
- Controlled lab-based ethical vulnerability assessment
Disclaimer
Performed exclusively in a private lab environment using Metasploitable 2 (a legal, purpose-built vulnerable target). No production systems, live networks, or unauthorised assets were involved.
Screenshots are included directly from the lab walkthrough for transparency and portfolio review.
Feel free to contact me for questions/collaboration.
Last updated: February 2026