Nessus, Qualys ve OpenVAS Güvenlik Zafiyeti Tarama Araçlarının Güvenlik Zafiyeti Bulunan İşletim Sistemleri ve Web Uygulamalarına Yönelik Tarama Yetenekleri

Öz

Kullanıcılar ve kurumsal sistemler arasında birincil arayüz görevi gören web uygulamaları, güvenlik açısından oldukça geniş atak yüzeyi içeren kritik uygulamalardır. SQL enjeksiyonu, sitelerde istem dışı komut çalıştırma (Cross Site Scripting-XSS) ve güvensiz kimlik doğrulama mekanizmaları gibi yaygın web uygulaması güvenlik açıkları, saldırganlara hassas verilere ve veritabanı gibi arkada bulunan kritik sistemlere doğrudan erişim imkanı sağlayabilir. Bu nedenle, güvenlik zafiyeti tarama araçlarının web uygulaması güvenlik zafiyetini etkili bir şekilde tespit etmesi ve raporlaması çok önemlidir. Güvenlik zafiyeti tarama araçları, bilgi sistemlerinde kullanılan yazılım ve donanımlardaki riskleri tespit etmek için yaygın olarak kullanılmaktadır. Bununla birlikte, bilgi sistemlerinde kullanılan yazılım ve donanımların çeşitliliği nedeniyle, güvenlik zafiyeti, tarama ve tespit araçlarının yetenekleri çok farklıdır. Bu yetenek farklılıkları, güvenlik zafiyeti tarama araçlarının karşılaştırılmasını zorlaştırmaktadır. Bu çalışmada, genel bilgi sistemi ve web uygulaması güvenlik açığı tespiti için gerekli karşılaştırma kriterleri belirlenmiştir. Yaygın olarak kullanılan Nessus, Qualys ve OpenVAS güvenlik zafiyeti tarama araçları belirlen bu kriterlere göre değerlendirilmiştir. Sonuçlar, güvenlik açığı içerdiği bilinen işletim sistemleri ve web uygulamaları üzerinde güvenlik açığı tarama araçları çalıştırılarak karşılaştırılmıştır.

Anahtar Kelimeler

• Zafiyet Tarma
• CVE
• Qualys
• Nessus
• OpenVAS
• Web Uygulaması

Scanning Capabilities of Nessus, Qualys and OpenVAS Vulnerability Scanner Tools for Vulnerable Operating Systems and Web Applications

Öz

Web applications, which serve as the primary interface between users and organizational systems, represent a particularly critical attack surface that requires specialized attention to ensure their security. Common web application vulnerabilities, such as SQL injection, cross-site scripting (XSS), and insecure authentication mechanisms, can provide attackers with direct access to sensitive data and backend systems. Therefore, it is crucial for vulnerability scanning tools to effectively detect and report web application security flaws. Vulnerability scanning tools are widely used to detect risks in the software and hardware used in information systems. However, owing to the variety of software and hardware used in information systems, vulnerability scanning and detection tools have very different capabilities. These differences in capabilities make it difficult to compare the vulnerability scanning tools. In this study, after determining the necessary comparison criteria for general information system and web application vulnerability detection, the widely used Nessus, Qualys, and OpenVAS vulnerability scanning tools were examined. The results were compared by running the vulnerability scanning tools on operating systems and web applications known to contain vulnerabilities.

Anahtar Kelimeler

• : Vulnerability Scanner
• CVE
• Nessus
• Qualys
• OpenVAS
• Web Application

Kaynakça

1. [1] S. Pandey and A. Chaudhary, “Vulnerability scanning,” 2023. doi: 10.36227/techrxiv.20317194.v1.
2. [2] R. Kushe, “Comparative study of vulnerability scanning tools: Nessus vs Retina,” INTERNATIONAL SCIENTIFIC JOURNAL “SECURITY & FUTURE,” vol. 1, no. 2, pp. 69–71, 2017.
3. [3] T. Singh and A. Kumar, “Analyzing security and privacy issues for multi-cloud service providers using Nessus,” in 2023 5th International Conference on Electrical, Computer and Communication Technologies, ICECCT 2023, Inc., doi: 10.1109/ICECCT56650.2023.10179727.
4. [4] K. Boonchuay, W. Siripaktanakon, O. Sangpetch, and A. Sangpetch, “Software vulnerability assessment: Vendor, Scanner, and User Analysis,” in Proceedings of the International Conference on Cloud Computing Technology and Science, CloudCom, IEEE Computer Society, 2022, pp. 214–221. doi: 10.1109/CloudCom55334.2022.00038.
5. [5] I. Chalvatzis, D. A. Karras, and R. C. Papademetriou, “Evaluation of security vulnerability scanners for small and medium enterprises business networks resilience towards risk assessment,” in 2019 IEEE International Conference on Artificial Intelligence and Computer Applications (ICAICA), 2019. doi: 10.1109/ICAICA.2019.8873438.
6. [6] M. A. Muin, Kapti, and T. Yusnanto, “Campus website security vulnerability analysis using Nessus,” International Journal of Computer and Information System (IJCIS) Peer Reviewed-International Journal, vol. 03, no. 2, pp. 79–82, 2020, doi: 10.29040/ijcis.v3i2.72.
7. [7] C. Ozturk and M. Kara, “5th International Eurasian Conference on Science, Engineering and Technology (EurasianSciEnTech 2024),” in Practical Comparison of Nessus, Qualys and OpenVAS Vulnerability Scanner Tools, Ankara:, Jun. 2024, pp. 710–716.
8. [8] M. Fu, C. K. Tantithamthavorn, V. Nguyen, and T. Le, “ChatGPT for Vulnerability Detection, Classification, and Repair: How Far Are We?,” in Proceedings - Asia-Pacific Software Engineering Conference, APSEC, IEEE Computer Society, 2023, pp. 632–636. doi: 10.1109/APSEC60848.2023.00085.

9. [9] C. Zhang, H. Liu, J. Zeng, K. Yang, Y. Li, and H. Li, “Prompt-Enhanced Software Vulnerability Detection Using ChatGPT,” in Proceedings of the 2024 IEEE/ACM 46th International Conference on Software Engineering: Companion Proceedings, ACM, Jan. 2024, pp. 276–277. doi: 10.1145/3639478.3643065.
10. [10] B. Zukran and M. M. Siraj, “Performance Comparison on SQL Injection and XSS Detection using Open Source Vulnerability Scanners,” in 2021 International Conference on Data Science and Its Applications, ICoDSA 2021, Institute of Electrical and Electronics Engineers Inc., 2021, pp. 61–65. doi: 10.1109/ICoDSA53588.2021.9617484.
11. [11] D. Moreira, J. P. Seara, J. P. Pavia, and C. Serrão, “Intelligent Platform for Automating Vulnerability Detection in Web Applications,” Electronics (Basel)., vol. 14, no. 1, p. 79, Dec. 2024, doi: 10.3390/electronics14010079.
12. [12] B. J. Santoso, R. M. Ijtihadie, and G. N. S. Aryawan, “Vulnerability Data Assessment and Management Based on Passive Scanning Method and CVSS,” in 2023 14th International Conference on Information and Communication Technology and System, ICTS 2023, pp. 325–330. doi: 10.1109/ICTS58770.2023.10330884.
13. [13] A. Balsam, M. Nowak, M. Walkowski, J. Oko, and S. Sujecki, “Analysis of CVSS Vulnerability Base Scores in the Context of Exploits’ Availability,” in 2023 23rd International Conference on Transparent Optical Networks (ICTON), IEEE, Jul. 2023, pp. 1–4. doi: 10.1109/ICTON59386.2023.10207394.
14. [14] R. Bhardwaj and D. Saraswat, “A Comparative Review of Vulnerability Assessment Tools: Insights from Qualys and Nessus,” International Journal of Engineering and Techniques, vol. 11, no. 5, pp. 135–140, Sep. 2025.
15. [15] A. Kejiou and G. Bekaroo, “A Review and comparative analysis of vulnerability scanning tools for wireless LANs,” in Proceedings - 3rd International Conference on Next Generation Computing Applications, NextComp 2022, Institute of Electrical and Electronics Engineers Inc., 2022. doi: 10.1109/NextComp55567.2022.9932245.
16. [16] K. Rahman and C. Izurieta, “A Mapping Study of Security Vulnerability Detection Approaches for Web Applications,” in Proceedings - 48th Euromicro Conference on Software Engineering and Advanced Applications, SEAA 2022, Institute of Electrical and Electronics Engineers Inc., 2022, pp. 491–494. doi: 10.1109/SEAA56994.2022.00081.
17. [17] D. R. Lakshmi and S. S. Mallika, “A Review on Web Application Testing and its Current Research Directions,” International Journal of Electrical and Computer Engineering (IJECE), vol. 7, no. 4, p. 2132, Aug. 2017, doi: 10.11591/ijece.v7i4.pp2132-2141.
18. [18] M. Aydos, Ç. Aldan, E. Coşkun, and A. Soydan, “Security testing of web applications: A systematic mapping of the literature,” Journal of King Saud University - Computer and Information Sciences, vol. 34, no. 9, pp. 6775–6792, Oct. 2022, doi: 10.1016/j.jksuci.2021.09.018.