Nessus扫描设置

本文描述的是关于Nessus的扫描设置，是基于Nessus官方文档进行的翻译，仅包含New Scan--Advanced Scan中的选项。

本文基于Nessus8.4的Home版本，官方文档原文链接：https://docs.tenable.com/nessus/Content/GettingStarted.htm

 

Basic基础设置 General常规设置
Setting	Default Value	Description
Targets目标	None	Specifies one or more targets to be scanned. If you select a target group or upload a targets file, you are not required to specify additional targets. Targets can be specified using a number of different formats. Tip: You can force Nessus to use a given host name for a server during a scan by using the hostname[ip] syntax (e.g., www.example.com[192.168.1.1]). 指定要扫描的一个或多个目标。如果选择目标组或上载目标文件，则无需指定其他目标。 可以使用多种不同格式指定目标。 提示：您可以使用hostname [ip]语法（例如，www.example.com [192.168.1.1]）强制Nessus在扫描期间使用服务器的给定主机名。
Upload Targets 上传目标文件	None	Uploads a text file that specifies targets. The targets file must be formatted in the following manner:     ASCII file format     Only one target per line     No extra spaces at the end of a line     No extra lines following the last target Note: Unicode/UTF-8 encoding is not supported. 上传指定目标的文本文件。 目标文件必须按以下方式格式化：     ASCII文件格式     每行只有一个目标     一行末尾没有多余的空格     最后一个目标后没有额外的行 注意：不支持Unicode / UTF-8编码。
DISCOVERY探索 Host Discovery主机探索
Setting	Default Value	Description
Ping the remote host Ping远程主机	On	This option enables Nessus to ping remote hosts on multiple ports to determine if they are alive. When set to On, General Settings and Ping Methods appear. Note: To scan VMware guest systems, Ping the remote host must be set to Off. 此选项使Nessus能够对多个端口上的远程主机执行ping操作，以确定它们是否处于活动状态。设置为“开”时，将显示“常规设置”和“Ping方法”。 注意：要扫描VMware guest虚拟机系统，必须将Ping远程主机设置为Off。
Use Fast Network Discovery 使用快速网络发现	Disabled	If a host responds to ping, Nessus attempts to avoid false positives, performing additional tests to verify the response did not come from a proxy or load balancer. Fast network discovery bypasses those additional tests. 如果主机响应ping，Nessus会尝试避免误报，执行其他测试以验证响应不是来自代理或负载均衡器。快速网络发现绕过了这些额外的测试。
ARP	Enabled	Ping a host using its hardware address via Address Resolution Protocol (ARP). This only works on a local network. 通过地址解析协议（ARP）使用其硬件地址对主机进行Ping操作。这仅适用于本地网络。
TCP	Enabled	Ping a host using TCP. 使用TCP ping主机。
Destination ports (TCP)	Built-In	Destination ports can be configured to use specific ports for TCP ping. This specifies the list of ports that are checked via TCP ping. 可以将此项配置为使用特定端口进行TCP ping。这指定了通过TCP ping检查的端口列表。
ICMP	Enabled	Ping a host using the Internet Control Message Protocol (ICMP). 使用Internet控制消息协议（ICMP）ping主机。
Assume ICMP unreachable from the gateway means the host is down 假设从网关无法访问ICMP意味着主机已关闭	Disabled	Assume ICMP unreachable from the gateway means the host is down When a ping is sent to a host that is down, its gateway may return an ICMP unreachable message. When this option is enabled, when Nessus receives an ICMP Unreachable message, it considers the targeted host dead. This is to help speed up discovery on some networks. Note: Some firewalls and packet filters use this same behavior for hosts that are up, but connected to a port or protocol that is filtered. With this option enabled, this leads to the scan considering the host is down when it is indeed up. 假设从网关无法访问ICMP，意味着当ping发送到已关闭的主机时主机已关闭，其网关可能会返回ICMP Unreachable消息。启用此选项后，当Nessus收到ICMP Unreachable消息时，它会认为目标主机已关闭。这有助于加速某些网络的发现。 注意：某些防火墙和数据包筛选器对已启动但连接到已过滤的端口或协议的主机使用相同的行为。启用此选项后，会导致扫描器认为主机已经关闭，即使主机是确实启动的。
Maximum number of retries 最大重试次数	2	Specifies the number of attempts to retry pinging the remote host. 指定重试ping远程主机的尝试次数。
UDP	Disabled	Ping a host using the User Datagram Protocol (UDP). UDP is a stateless protocol, meaning that communication is not performed with handshake dialogues. UDP-based communication is not always reliable, and because of the nature of UDP services and screening devices, they are not always remotely detectable. 使用用户数据报协议（UDP）ping主机。 UDP是无状态协议，意味着不使用握手对话进行通信。基于UDP的通信并不总是可靠的，并且由于UDP服务和筛选设备的性质，它们并不总是可远程检测到的。
Scan Network Printers 扫描网络打印机	Disabled	When enabled, Nessus scans network printers. 启用后，Nessus会扫描网络打印机。
Scan Novell Netware hosts 扫描Novell Netware主机	Disabled	When enabled, Nessus scans Novell NetWare hosts. 启用后，Nessus将扫描Novell NetWare主机。
Scan Operational Technology devices 扫描操作技术设备	Disabled	When enabled, Nessus performs a full scan of Operational Technology (OT) devices such as programmable logic controllers (PLCs) and remote terminal units (RTUs) that monitor environmental factors and the activity and state of machinery. When disabled, Nessus uses ICS/SCADA Smart Scanning to cautiously identify OT devices and stops scanning them once they are discovered. 启用后，Nessus会对可操作技术（OT）设备进行全面扫描，例如可编程逻辑控制器（PLC）和远程终端设备（RTU），用于监控环境因素以及机器的活动和状态。禁用时，Nessus使用ICS / SCADA智能扫描小心的识别OT设备，并在发现OT设备后停止扫描。
List of MAC Addresses MAC地址列表	None	The Wake-on-LAN (WOL) menu controls which hosts to send WOL magic packets to before performing a scan. Hosts that you want to start prior to scanning are provided by uploading a text file that lists one MAC address per line. For example: 33:24:4C:03:CC:C7 FF:5C:2C:71:57:79 Wake-on-LAN（WOL）菜单控制在执行扫描之前将WOL magic packets发送到哪个主机。 通过上载每行列出一个MAC地址的文本文件来提供要在扫描之前启动的主机。 例如： 33:24:4C:03:CC:C7 FF:5C:2C:71:57:79
Boot time wait (in minutes) 启动时间等待（以分钟为单位）	5	The amount of time to wait for hosts to start before performing the scan. 在执行扫描之前等待主机启动的时间。
DISCOVERY探索 Port Scanning端口扫描
Consider Unscanned Ports as Closed 将未扫描端口视为已关闭	Disabled	If a port is not scanned with a selected port scanner (for example, the port falls outside of the specified range), Nessus considers it closed. 如果使用选定的端口扫描程序没有扫描这些端口（例如，端口超出指定范围），Nessus会认为它已关闭。
Port Scan Range 端口扫描范围	Default	Two keywords can be typed into the Port scan range box.     default instructs Nessus to scan approximately 4,790 commonly used ports. The list of ports can be found in the nessus-services file.     all instructs Nessus to scan all 65,536 ports, including port 0. Additionally, you can type a custom range of ports by using a comma-delimited list of ports or port ranges. For example, 21,23,25,80,110 or 1-1024,8080,9000-9200. If you wanted to scan all ports excluding port 0, you would type 1-65535. The custom range specified for a port scan is applied to the protocols you have selected in the Network Port Scanners group of settings. If scanning both TCP and UDP, you can specify a split range specific to each protocol. For example, if you want to scan a different range of ports for TCP and UDP in the same policy, you would type T:1-1024,U:300-500. You can also specify a set of ports to scan for both protocols, as well as individual ranges for each separate protocol. For example, 1-1024,T:1024-65535,U:1025. 可以在“端口扫描范围”框中键入两个关键字。     default表示Nessus扫描大约4,790个常用端口。可以在nessus-services文件中找到端口列表。     all表示Nessus扫描所有65,536个端口，包括端口0。 此外，您可以使用逗号分隔的端口或端口范围列表来键入自定义端口范围。例如，21,23,25,80,110或1-1024,8080,9000-9200。如果要扫描除端口0之外的所有端口，请键入1-65535。 为端口扫描指定的自定义范围将应用于您在“网络端口扫描程