Vulnerability Scanning with Nmap Nessus and OpenVAS — Find Real Flaws Before Attackers

Your server has 80 open ports, but you don't know which ones are vulnerable. Or you think "Nmap is just for port discovery" and "Nessus is too slow." Every day we see companies discovering they've been breached only when the site goes down or data gets encrypted. It's not because of a "super hacker": it's because of months-old known vulnerabilities that no one scanned for.

We, at Meteora Web, have managed servers for 8 years: we've seen WordPress with outdated plugins exposed on port 8443, databases with plaintext credentials, SSH services with weak authentication. You don't need to be a genius: you need methodical scanning. In this guide we get straight into Nmap, Nessus, and OpenVAS: when to use them, how to combine them, how to read results without panicking. We start from the problem, not from theory.

Why Vulnerability Scanning is a Necessity, Not a Luxury

If you don't scan your network, someone else will. It sounds like a cliché, but it's reality. Vulnerabilities aren't magic holes — they're open ports, outdated services, misconfigurations. An automated scanner finds them in minutes. We run one on every project before deployment: it costs less than an hour of work and prevents thousands of euros in damages. You don't need to be a certified pentester: you need to know which commands to run and how to interpret the output.

Vulnerability Scanning vs. Penetration Testing

Scanning is the thermometer — it tells you where the heat is. Penetration testing is the diagnosis — it verifies if the heat is dangerous by exploiting the flaw. Don't skip scanning to go straight to testing: you'll waste time on the wrong targets. Scan first, prioritize second, test third.

When to Use Nmap for Reconnaissance and When to Switch to Nessus or OpenVAS

Nmap is your first step: fast, lightweight, gives you a network map. Nessus and OpenVAS are metal detectors — they dig deeper, look for CVE's, verify versions. The right question isn't "Nmap or Nessus?", but "when Nmap and when Nessus?"

Network Scanning with Nmap: Ports, Services, and OS Fingerprinting

Nmap isn't just for ping sweeps. With the right flags you identify operating systems, service versions, and even firewalls. Here's a command we use in every initial audit:

nmap -sV -sC -O -A --reason -p- -T4 target.com

-sV: version detection. -sC: default NSE scripts. -O: OS detection. -A: aggregation (OS, version, traceroute). --reason: explains why a port is open/closed. -p-: all 65535 ports. -T4: aggressive timing. Output shows everything: from Apache 2.4.49 (vulnerable to path traversal) to OpenSSH 7.4 (with known CVE's). We use it before every new server deployment: in 10 minutes we have an exact snapshot.

OpenVAS for In-Depth Scanning Without Paid Licenses

OpenVAS (now part of Greenbone) is the open-source standard for vulnerability scanning. Install it via Docker or on a dedicated VM. After setup, create a target and run a "Full and fast" scan: in 30–60 minutes you'll get a report with hundreds of checks, from misconfigured SSL to critical vulnerabilities. The downside is false positives — but with experience you learn to filter them. We use it for budget-conscious clients: it offers the same level of control as Nessus but requires more interpretation time.

Nessus Professional for Ready-Made Reports and Compliance

Nessus costs a few hundred euros per year but gives you reports ready for audits, PCI-DSS compliance, and SIEM integration. The difference from OpenVAS is false positive quality: Nessus is cleaner, categorizes vulnerabilities by severity, and provides step-by-step remediation. We use it for clients who need to pass security audits or want a report to share with management. No CLI command needed — use the web interface or the API for scripted scans.

How to Automate Periodic Scanning Without Going Crazy

Scanning once in a while is useless. New vulnerabilities appear daily: new CVE's, system updates, configuration changes. The solution is a script that runs Nmap on a target list and sends a report via email, or a cron job that launches OpenVAS with a dynamic target. Here's an automation example with Nmap and simple notification:

#!/bin/bash
TARGET="192.168.1.0/24"
OUTPUT="/var/log/nmap-scan-$(date +%Y%m%d).xml"
/usr/bin/nmap -sV -sC -oX $OUTPUT $TARGET
# If critical ports found, send alert
if grep -q "open" $OUTPUT; then
  mail -s "Nmap scan: open ports on $TARGET" admin@domain.com < $OUTPUT
fi

We schedule this script on an internal server for each maintenance client: the alert arrives weekly. For deeper scans, we use the Greenbone API to launch OpenVAS via cron and retrieve PDF reports.

How to Interpret Results: Critical Vulnerabilities, False Positives, and Priorities

A scanner buries you in data. Real skill is knowing how to read. We classify into three levels: critical (remote code execution, SQL injection, hardcoded credentials), high (privilege escalation, persistent XSS), medium (old service version but not directly exploitable). False positives are common: a service that shows an old version but has backported patches, a port open only for internal backup. To verify, we use Nmap with specific NSE scripts or manual service checks.

Examples of False Positives and How to Spot Them

OpenVAS flags "SSL/TLS: Certificate Expiry" even for internal expired certificates used only in LAN. Nessus flags "Apache mod_status enabled" even if the module is active but protected by IP whitelist. Don't trust blindly — verify. We have a protocol: every critical vulnerability gets manually tested, every high gets double-checked with a custom script, the rest gets scheduled for the next update cycle.

What to Do Next: Immediate Actions

Don't just read. In the next 30 minutes, do this:

• Install Nmap on a Linux or Windows machine (nmap.org/download.html). Run the command above on your public IP (if you have a server). If you don't have a server, scan your home LAN — you'll be surprised how many things are exposed.
• Configure OpenVAS on a VM (greenbone.github.io/docs/latest/). Create a target with your domain or IP. Run a "Full and fast" scan. The first result will open your eyes.
• Don't panic if you see hundreds of vulnerabilities. Prioritize: critical and high. For each one, look up the CVE on NVD and the fix on Exploit-DB. Then close unnecessary ports, update services, change credentials.

Scanning is not a race — it's a habit. We do it for every client, every week. If you need support, we're based in Sciacca but work across Italy. Sometimes a one-hour consultation is enough to fix the biggest issues.