What it does. Plan and run authenticated (credentialed) vulnerability scans with scanners such as Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-authenticated-vulnerability-scan, or copy the skill folder into ~/.claude/skills/performing-authenticated-vulnerability-scan/.- Raw file:
curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-authenticated-vulnerability-scan/SKILL.md
SKILL.md (verbatim)
name: performing-authenticated-vulnerability-scan
description: Plan and run authenticated (credentialed) vulnerability scans with scanners such as
Nessus, Qualys, OpenVAS, or Rapid7 InsightVM, using SSH, SMB, WinRM, or SNMPv3 credentials
to inspect installed software, patches, and configurations on Linux, Windows, and network
devices. Use when a scan must catch vulnerabilities unauthenticated scanning misses, or when
choosing and managing credential types for a credentialed scan.
domain: cybersecurity
subdomain: vulnerability-management
tags:
- vulnerability-management
- cve
- authenticated-scanning
- credentials
- nessus
- qualys
- risk
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-02
- ID.IM-02
- ID.RA-06
mitre_attack:
- T1190
- T1203
- T1068
- T1003
- T1110
Performing Authenticated Vulnerability Scan
Overview
Authenticated (credentialed) vulnerability scanning uses valid system credentials to log into target hosts and perform deep inspection of installed software, patches, configurations, and security settings. Compared to unauthenticated scanning, credentialed scans detect 45-60% more vulnerabilities with significantly fewer false positives because they can directly query installed packages, registry keys, and file system contents.
When to Use
- When conducting security assessments that involve performing authenticated vulnerability scan
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Prerequisites
- Vulnerability scanner (Nessus, Qualys, OpenVAS, Rapid7 InsightVM)
- Service accounts with appropriate privileges on target systems
- Secure credential storage (vault integration preferred)
- Network access from scanner to target management ports
- Written authorization from system owners
Core Concepts
Why Authenticated Scanning
Unauthenticated scanning can only assess externally visible services and banners, often leading to:
- Missed vulnerabilities in locally installed software
- Inaccurate version detection from banner changes
- Inability to check patch levels, configurations, or local policies
- Higher false positive rates due to inference-based detection
Authenticated scanning resolves these by directly querying the target OS.
Linux/Unix Systems
- SSH Key Authentication: RSA/Ed25519 key pairs (recommended)
- SSH Username/Password: Fallback for systems without key-based auth
- Sudo/Su Elevation: Non-root user with sudo privileges
- Certificate-based SSH: X.509 certificates for enterprise environments
Windows Systems
- SMB (Windows): Domain or local admin credentials
- WMI: Windows Management Instrumentation queries
- WinRM: Windows Remote Management (HTTPS preferred)
- Kerberos: Domain authentication with service tickets
Network Devices
- SNMP v3: USM with authentication and privacy (AES-256)
- SSH: For Cisco IOS, Juniper JunOS, Palo Alto PAN-OS
- API Tokens: REST API for modern network platforms
Databases
- Oracle: SYS/SYSDBA credentials or TNS connection
- Microsoft SQL Server: Windows auth or SQL auth
- PostgreSQL: Role-based authentication
- MySQL: User/password with SELECT privileges
Workflow
Step 1: Create Dedicated Service Accounts
# Linux: Create scan service account
sudo useradd -m -s /bin/bash -c "Vulnerability Scanner Service Account" nessus_svc
sudo usermod -aG sudo nessus_svc
# Configure sudo for passwordless specific commands
echo 'nessus_svc ALL=(ALL) NOPASSWD: /usr/bin/dpkg -l, /usr/bin/rpm -qa, \
/bin/cat /etc/shadow, /usr/sbin/dmidecode, /usr/bin/find' | sudo tee /etc/sudoers.d/nessus_svc
# Generate SSH key pair
sudo -u nessus_svc ssh-keygen -t ed25519 -f /home/nessus_svc/.ssh/id_ed25519 -N ""
# Distribute public key to targets
for host in $(cat target_hosts.txt); do
ssh-copy-id -i /home/nessus_svc/.ssh/id_ed25519.pub nessus_svc@$host
done
# Windows: Create scan service account via PowerShell
New-ADUser -Name "SVC_VulnScan" `
-SamAccountName "SVC_VulnScan" `
-UserPrincipalName "SVC_VulnScan@domain.local" `
-Description "Vulnerability Scanner Service Account" `
-PasswordNeverExpires $true `
-CannotChangePassword $true `
-Enabled $true `
-AccountPassword (Read-Host -AsSecureString "Enter Password")
# Add to local Administrators group on targets via GPO or:
Add-ADGroupMember -Identity "Domain Admins" -Members "SVC_VulnScan"
# For least privilege, use a dedicated GPO for local admin rights instead
# Enable WinRM on targets
Enable-PSRemoting -Force
Set-Item WSMan:\localhost\Service\AllowRemote -Value $true
winrm set winrm/config/service '@{AllowUnencrypted="false"}'
Nessus Configuration
{
"credentials": {
"add": {
"Host": {
"SSH": [{
"auth_method": "public key",
"username": "nessus_svc",
"private_key": "/path/to/id_ed25519",
"elevate_privileges_with": "sudo",
"escalation_account": "root"
}],
"Windows": [{
"auth_method": "Password",
"username": "DOMAIN\\SVC_VulnScan",
"password": "stored_in_vault",
"domain": "domain.local"
}],
"SNMPv3": [{
"username": "nessus_snmpv3",
"security_level": "authPriv",
"auth_algorithm": "SHA-256",
"auth_password": "stored_in_vault",
"priv_algorithm": "AES-256",
"priv_password": "stored_in_vault"
}]
}
}
}
}
Step 3: Validate Credential Access
# Test SSH connectivity
ssh -i /path/to/key -o ConnectTimeout=10 nessus_svc@target_host "uname -a && sudo dpkg -l | head -5"
# Test WinRM connectivity
python3 -c "
import winrm
s = winrm.Session('target_host', auth=('DOMAIN\\\\SVC_VulnScan', 'password'), transport='ntlm')
r = s.run_cmd('systeminfo')
print(r.std_out.decode())
"
# Test SNMP v3 connectivity
snmpwalk -v3 -u nessus_snmpv3 -l authPriv -a SHA-256 -A authpass -x AES-256 -X privpass target_host sysDescr.0
Step 4: Run Authenticated Scan
Configure and launch the scan using the Nessus API:
# Create scan with credentials
curl -k -X POST https://nessus:8834/scans \
-H "X-Cookie: token=$TOKEN" \
-H "Content-Type: application/json" \
-d '{
"uuid": "'$TEMPLATE_UUID'",
"settings": {
"name": "Authenticated Scan - Production",
"text_targets": "192.168.1.0/24",
"launch": "ON_DEMAND"
},
"credentials": {
"add": {
"Host": {
"SSH": [{"auth_method": "public key", "username": "nessus_svc", "private_key": "/keys/id_ed25519"}],
"Windows": [{"auth_method": "Password", "username": "DOMAIN\\SVC_VulnScan", "password": "vault_ref"}]
}
}
}
}'
Step 5: Verify Credential Success
After scan completion, check credential verification results:
- Plugin 19506 (Nessus Scan Information): Shows credential status
- Plugin 21745 (OS Security Patch Assessment): Confirms local checks
- Plugin 117887 (Local Security Checks): Credential verification
- Plugin 110385 (Nessus Credentialed Check): Target-level auth status
Credential Security Best Practices
- Use a secrets vault (HashiCorp Vault, CyberArk, AWS Secrets Manager) for credential storage
- Rotate credentials every 90 days or after personnel changes
- Principle of least privilege - only grant minimum required access
- Audit credential usage - monitor service account login events
- Encrypt in transit - use SSH keys over passwords, WinRM over HTTPS
- Separate accounts per scanner - never share credentials across tools
- Disable interactive login for scan service accounts where possible
- Log all authentication events for scan accounts in SIEM
Common Pitfalls
- Using domain admin accounts instead of least-privilege service accounts
- Storing credentials in plaintext scan configurations
- Not testing credentials before scan launch (leads to wasted scan windows)
- Forgetting to configure sudo/elevation for Linux targets
- Windows UAC blocking remote credentialed checks
- Firewall rules blocking WMI/WinRM/SSH between scanner and targets
- Credential lockout from multiple failed authentication attempts
- scanning-infrastructure-with-nessus
- performing-network-vulnerability-assessment
- implementing-continuous-vulnerability-monitoring
Other files in this skill
assets/template.md (verbatim)
Authenticated Vulnerability Scan Report Template
Scan Configuration
| Field |
Value |
| Scan Date |
[YYYY-MM-DD] |
| Scanner |
[Nessus/Qualys/OpenVAS] |
| Scan Type |
Authenticated (Credentialed) |
| Targets |
[TARGET_RANGE] |
| Credential Types |
SSH / WinRM / SMB / SNMPv3 |
Credential Success Summary
| Protocol |
Targets |
Success |
Failed |
Rate |
| SSH |
[N] |
[N] |
[N] |
[%] |
| WinRM |
[N] |
[N] |
[N] |
[%] |
| SMB |
[N] |
[N] |
[N] |
[%] |
| SNMPv3 |
[N] |
[N] |
[N] |
[%] |
| Total |
[N] |
[N] |
[N] |
[%] |
Findings Summary (Authenticated vs Unauthenticated Comparison)
| Severity |
Auth Scan |
Unauth Scan |
Delta |
| Critical |
[N] |
[N] |
[+N] |
| High |
[N] |
[N] |
[+N] |
| Medium |
[N] |
[N] |
[+N] |
| Low |
[N] |
[N] |
[+N] |
Authentication Failures
| Host |
Protocol |
Failure Reason |
Remediation |
| [IP] |
[SSH/WinRM] |
[reason] |
[action] |
Recommendations
- Credential Coverage: [Current %] - Target: >95%
- Failed Hosts: Investigate [N] authentication failures
- Privilege Gaps: [N] hosts missing sudo/admin elevation
- Credential Rotation: Next rotation due [DATE]
references/api-reference.md (verbatim)
Authenticated Vulnerability Scan — API Reference
Libraries
| Library |
Install |
Purpose |
| requests |
pip install requests |
Nessus REST API client |
Nessus REST API Authentication
Header: X-ApiKeys: accessKey=<key>; secretKey=<key>
Nessus API Endpoints
| Method |
Endpoint |
Description |
| GET |
/scans |
List all scans |
| GET |
/scans/{id} |
Scan details with results |
| GET |
/scans/{id}/hosts/{host_id} |
Per-host vulnerability details |
| POST |
/scans |
Create new scan |
| POST |
/scans/{id}/launch |
Launch existing scan |
| POST |
/scans/{id}/export |
Export results (nessus/csv/html) |
| GET |
/policies |
List scan policies |
| GET |
/credentials |
List stored credentials |
Severity Levels
| Index |
Name |
CVSS Range |
| 4 |
Critical |
9.0 - 10.0 |
| 3 |
High |
7.0 - 8.9 |
| 2 |
Medium |
4.0 - 6.9 |
| 1 |
Low |
0.1 - 3.9 |
| 0 |
Info |
Informational |
Credential Types for Authenticated Scans
| Type |
Protocol |
Checks Enabled |
| SSH |
Linux/macOS |
Package versions, file permissions, configs |
| SMB |
Windows |
Patch levels, registry, installed software |
| ESXi |
VMware |
Hypervisor patches, VM configurations |
| SNMP |
Network devices |
Device firmware, community string audit |
| Database |
SQL Server/Oracle |
DB-level patches, user permissions |
Key Nessus Plugin Families
| Family |
Description |
| Windows: Microsoft Bulletins |
Microsoft security patches |
| Ubuntu Local Security Checks |
Ubuntu package vulnerabilities |
| CGI abuses |
Web application vulnerabilities |
| Misc. |
Miscellaneous security checks |
| Service detection |
Network service identification |
External References
references/standards.md (verbatim)
Standards and References - Authenticated Vulnerability Scanning
Industry Standards
- NIST SP 800-115: Technical Guide to Information Security Testing and Assessment
- NIST SP 800-53 RA-5: Vulnerability Scanning (requires credentialed scanning for compliance)
- CIS Controls v8 Control 7.5: Perform automated vulnerability scans of internal assets on a quarterly basis using authenticated scanning
- PCI DSS v4.0 Req 11.3.1: Internal vulnerability scans must use authenticated scanning
- DISA STIG: Requires credentialed scanning for compliance validation
Credential Management Standards
- NIST SP 800-63B: Digital Identity Guidelines - Authentication and Lifecycle Management
- CIS Controls v8 Control 5: Account Management
- OWASP Credential Storage Cheat Sheet: Secure credential handling best practices
Scanner Documentation
Verification Plugins (Nessus)
| Plugin ID |
Name |
Purpose |
| 19506 |
Nessus Scan Information |
Shows scan metadata and credential status |
| 21745 |
OS Security Patch Assessment |
Confirms local security checks enabled |
| 117887 |
Local Security Checks Enabled |
Per-host credential verification |
| 110385 |
Nessus Credentialed Check |
Detailed credential success/failure |
| 10394 |
Microsoft Windows SMB Log In Possible |
Windows SMB auth verification |
| 10180 |
Ping the Remote Host |
Host reachability confirmation |
Minimum Privileges Required
| Platform |
Minimum Privilege |
Notes |
| Linux |
Root or sudo user |
Sudo with NOPASSWD for specific commands |
| Windows |
Local Administrator |
Or domain account with local admin GPO |
| Cisco IOS |
Privilege 15 |
Enable mode access required |
| SNMP |
Read-only (v3 authPriv) |
SNMPv3 with encryption |
| Oracle DB |
SELECT ANY DICTIONARY |
Minimum for audit queries |
| PostgreSQL |
pg_read_all_settings |
Read-only role sufficient |
references/workflows.md (verbatim)
Workflows - Authenticated Vulnerability Scanning
Workflow 1: Credential Preparation and Validation
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ Create Service │────>│ Configure Least │────>│ Test Credentials │
│ Accounts │ │ Privilege Access │ │ on Sample Hosts │
└──────────────────┘ └──────────────────┘ └──────────────────┘
│
┌────────────────────────────────────────────────┘
v
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ Store in Secrets │────>│ Configure Scanner│────>│ Validate Auth │
│ Vault │ │ Credentials │ │ Success Rate │
└──────────────────┘ └──────────────────┘ └──────────────────┘
Workflow 2: Authenticated Scan Execution
- Pre-scan: Verify credentials, check network connectivity, confirm scan window
- Discovery: Host enumeration to identify live targets
- Authentication: Scanner authenticates to each target host
- Local Enumeration: Query installed packages, patches, configurations
- Vulnerability Assessment: Match local data against vulnerability database
- Report Generation: Compile findings with credential success metrics
- Post-scan: Verify no service disruption, archive results
Workflow 3: Credential Success Monitoring
Scan Completion
│
├──> Check Plugin 117887 (Local Security Checks)
│ │
│ ├──> SUCCESS: Proceed to analyze findings
│ └──> FAILURE: Investigate cause
│ │
│ ├──> Network connectivity issue
│ ├──> Credential expired or changed
│ ├──> Firewall blocking management ports
│ ├──> Account locked out
│ └──> Insufficient privileges
│
└──> Calculate Credential Success Rate
│
├──> Target: >95% authenticated hosts
├──> Alert if <90% success rate
└──> Document exceptions for failed hosts
Workflow 4: Credential Lifecycle Management
| Phase |
Action |
Frequency |
| Provisioning |
Create accounts with least privilege |
One-time |
| Distribution |
Deploy keys/passwords to scanner |
One-time |
| Validation |
Test connectivity before scans |
Per scan |
| Rotation |
Change passwords, rotate keys |
90 days |
| Monitoring |
Audit login events in SIEM |
Continuous |
| Deprovisioning |
Remove accounts when scanner retired |
As needed |
Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.