Introduction

Nessus enjoys widespread support in the field of computer security today in no small part due to the work of its principal authors. However, design and coding excellence will take a product only so far. What sets Nessus apart from other network vulnerability assessment tools is its openness and its user community.

Thanks to its openness, anyone can browse the source for Nessus and its plugins to learn how they work. Moreover, with the knowledge gained, anyone can contribute to the Nessus Project by adding features to and fixing problems in the existing software base, deriving new plugins from existing ones, and developing third-party tools and resources.

Thanks to its user community, such contributions are indeed being made. In terms of software, you can currently find a Nessus client for Windows, several Web-based interfaces for configuring and managing scans, various tools for displaying and managing results, programming interfaces such as the Net::Nessus: :ScanLite and Parse::Nessus::NBE Perl modules, and a continuous stream of plugins, all authored by dozens of individuals and businesses not explicitly part of the Nessus Project. In terms of resources, Hugo van der Kooij s Nessus FAQ and Edgeos Nessus Knowledge Base have recently emerged to help the community better understand Nessus. The user community even contributes by simply submitting signatures for previously unidentified services in response to instructions in reports from the various fingerprinting plugins. This form of contribution alone has proven extremely valuable, for it has enabled Nessus to leapfrog its competition in the area of...