GPEN · Question #467
During a penetration test you discover a valid set of SSH credentials to a remote system. How can this be used to your advantage in a Nessus scan?
The correct answer is C. The "SSH' box can be checked to let Nessus know the remote system is running. Valid SSH credentials discovered during a penetration test can be entered into Nessus to enable credentialed scanning, which reveals far more vulnerabilities than unauthenticated scans.
Question
During a penetration test you discover a valid set of SSH credentials to a remote system. How can this be used to your advantage in a Nessus scan?
Options
- AThis information can be entered under the 'Hydra' tab to launch a brute-forcepassword attack.
- BThere isn't an advantage as Nessus will ultimately discover this information.
- CThe "SSH' box can be checked to let Nessus know the remote system is running
- DThis information can be entered under the 'credentials' tab to allow Nessus to log into the
How the community answered
(37 responses)- A3% (1)
- B8% (3)
- C76% (28)
- D14% (5)
Why each option
Valid SSH credentials discovered during a penetration test can be entered into Nessus to enable credentialed scanning, which reveals far more vulnerabilities than unauthenticated scans.
Hydra is a separate standalone brute-force password-cracking tool and is not a built-in Nessus tab or feature - it is used to find credentials, not to leverage already-discovered ones.
Nessus does gain a measurable advantage from valid credentials because authenticated scans expose a significantly broader set of host-level vulnerabilities that unauthenticated scans cannot detect.
Checking the SSH option and supplying discovered credentials allows Nessus to authenticate directly to the remote system and perform a credentialed scan, which assesses local patch levels, configuration weaknesses, and host-level vulnerabilities that are invisible to unauthenticated network scans. This transforms a surface-level scan into a privileged internal assessment using the found credentials.
Manually entering credentials under the credentials tab is a configuration step but does not by itself describe the specific SSH-based mechanism that option C identifies as the advantage in the scan.
Concept tested: Nessus credentialed SSH scanning configuration
Source: https://docs.tenable.com/nessus/Content/SSH.htm
Topics
Community Discussion
No community discussion yet for this question.