Whenever a scan has been completed, we can simply click on it to access a very nice dashboard with the statistics. Exporting the results in various formats, such as PDF, HTML, CSV, and so on, is quite simple. Exporting the results will allow you to save the report offline. This will be beneficial as a penetration tester for either revisiting the vulnerability assessment details at a later time or providing the report to the people concerned (clients or team members).
To export the results of a Nessus scan, follow these steps:
- Open the scan and click on Export:
- You'll have the option to select the output format. Then, the export wizard will provide another option to generate the final output as an Executive Summary or to customize a report to your personal preference:
- Should you choose to create a custom report, the following options are available:
The executive report is better suited for upper management staff who are not concerned about all the technical details of the vulnerability assessment but rather the main overview of the report. The custom report can be used to include or remove specific details, based on what is required and the reader's interest.
The following is a sample of the executive report generated for a vulnerability scan on the Metasploitable VM within our lab:
As you can see, a severity rating and a score are assigned to each vulnerability found on the target. The Common Vulnerability Scoring System (CVSS) is a quantitative vulnerability scoring system that helps security professionals to determine the severity of a threat, exploit, or even a security weakness.
In this section, you have learned about the various formats for exporting Nessus results, the benefits of exporting reports offline, and types of reports. In the upcoming section, we will dive deep into analyzing the output/results provided by Nessus.