Download All Nessus Plugins
Stephanie Dejoode
Clicking on the Plugin Family allows you to enable (green) or disable (gray) the entire family. Selecting a family shows the list of its plugins. You can enable or disable individual plugins to create specific scans.
A family with some plugins disabled is purple and shows Mixed to indicate only some plugins are enabled. Clicking on the plugin family loads the complete list of plugins, and allow for granular selection based on your scanning preferences.
I have a fully working vulnerability response integration with tenable.io. We have a requirement to switch from CVSS 2.0 to CVSS 3.0 for severity calculation. We had changed the settings in Tenable.io from using CVSS 2.0 to CVSS 3.0 for severity and it correctly shows the plugin severity based on CVSS 3.0 in tenable.io. I had reimported the plugins in VR, however, the tenable plugin severity values in VR are still based on CVSS 2.0 score. An example would be plugin 174238 which has CVSS 2.0 medium but CVSS 3.0 high severity. We use the plugin severity value to map the risk rating for the VIT i.e. if the plugin severity is medium then risk rating is medium. Is there a fix to switch plugin severity calculation in VR from using CVSS 2.0 to using CVSS 3.0 for the plugin imported from tenable? I would rather keep the risk rating based on plugin severity in VR than to calculate it using the vulnerability score (v3) field instead.
Tens of thousands of plugins have been written in NASL for Nessus and OpenVAS.[1] Files that are written in this language usually get the file extension .nasl. For the exploitation of a zero day attack it is possible for an end user of Nessus or OpenVAS to write custom code in NASL which is executed by these vulnerability scanners.
If the plugin, in this example myzeroday.nasl, is placed in the same directory where other NASL plugins are located, it can also be included in standard scans by Nessus or OpenVAS, via the Web GUI or an API.
The Nessus scanner supports a plugin architecture that allows anyone to develop security checks in the NASL (Nessus Attack Scripting Language) language. We have contributed the plugins below to the Nessus effort.
Cross Site Scripting
(by Sullo, now replaced by Tenable). This plugin checks web servers to see if they are vulnerable to the cross site scripting (XSS) problems. Unlike previous plugins, this checks multiple file extensions that may effect multiple different web servers.