Nessus

And if you think you have everything covered, try vulnerability assessment tools like hydra, nessus, and nmap.

Organizations can use a tool like the Nessus tool to audit business critical enterprise devices and applications.

This mechanism meets our requirement that encapsulating the Nessus tool and user information database in a portlet.

The calls to the Nessus tool and user information database are encapsulated in two classes.

I assembled a file using the field called Nessus_HOST (as shown in Listing 4), and then I stored it into directory called target.

The attacker can use tools such as Nessus or any number of utilities to perform such a scan.

After you create a Nessus class instance, it needs to be initialized.

The Nessus tool needs a target file as an argument for the scan.

A portlet service integrates the scanning tool (in this example, the Nessus tool) and the user database.

Figure 1 illustrates a simple view of integrating this on demand security portal with the Nessus tool and the user database.

The Nessus class controls and interacts with the Nessus tool.

The Nessus server runs on the Linux platform only.

Listing 1 illustrates the format of Nessus command-line.

You set the configuration information in the class, so that it can locate and call the Nessus tool.

Listing 4: Initializing a Nessus class instance

Listing 3: Constructor for the Nessus class