Core Compute & Architecture
nessusd Core Daemon
The entire architecture revolves around a single, highly stressed daemon. It orchestrates dynamic execution, scheduling complex dependency chains during scans (e.g., waiting for FTP banners before memory checks).
NASL Compilation Engine
Raw .nasl scripts are not executed directly. They are compiled into an obfuscated .nbin bytecode format. This compilation process is notoriously resource-intensive and constitutes the primary infrastructure bottleneck.
Under the Hood Architecture
Credential Manager
Securely stores and injects highly privileged administrative credentials into target Windows and Linux hosts via SMB, SSH, or WMI, bypassing the need for persistent heavy agents.
Agent Safe Mode Telemetry
When a Tenable Agent crashes, it enters safe mode, intentionally maintaining a persistent beaconing C2 connection to Tenable Cloud, transmitting diagnostic data and accepting remote commands.
Real-World Attack Surface
Manager Credential Theft
Scanners are the ultimate targets for APTs. Compromising the Nessus Manager console grants instant, unobstructed lateral movement using legitimate stored domain administrative credentials.
Hostile Server RCE
Malicious target servers returning highly malformed HTTP headers or recursive ASN.1 structures can trigger buffer overflows in the nessusd parser, leading to Remote Code Execution on the scanner.
Mandatory Hardening Baseline
- Tier-0 Network Isolation: Scanning infrastructure must be deployed on hardened, strict VLANs with outbound access restricted solely to target subnets and Tenable update servers.
- Throttle Compilation Engines: Set `scan_performance_mode` to Low/Medium to prevent the nessusd compilation thread-pool from exhausting shared hypervisor CPU resources.
Security Tool Comparison
| Component | Nessus | Burp Suite |
|---|---|---|
| Core Architecture | nessusd Core Daemon | Monolithic Java JVM |
| Primary Risk | Scan Compilation OOMs, C2 Beacons | AI Data Leakage, Project RCE |
| State Management | Proprietary Database | SQLite / FlatBuffers |
| Mandatory Hardening | VLAN Segregation, Low CPU threads | Disable AI, 16GB+ RAM |
