1

I need to do a vulnerability scan report for my company, does anyone know the tools I should use and a template?

8 Spice ups
2

A good place to start would be the Nesus vulnerability scanner We use it here to scan hundreds of servers and workstations for vulnerabilities. Nessus Vulnerability Scanner: Network Security Solution | Tenable® Works awesome. But may be pricey for you.

3

yeah, my company is small and I was thinking about something that I could do myself.

4

You could also look into GFI Languard. GFI is has Green Guy/Gals here in the community.

5

Beyondtrust Retina, Rapid7 Nexpose, Nmap, OpenVAS is a free fork of Nessus, or get a trial of Core Impact from Core Security. Core Impact is widely considered as the most powerful exploitation and vulnerability management solution available but it’s probably the most expensive too.

1 Spice up
6

http://www.rapidfiretools.com/nd_overview.shtml

I haven’t used their security scans yet, but their network scanning is really nice. It produces nice reports that you can modify to meet your business and present them to management. The tools are free, but to generate a report costs $50. You can also buy unlimited for a small amount annually.

I can’t vouch for the tools mentioned in above comments, but if you’re looking for reporting I can tell you this will provide good results.

7

Kali includes OpenVas and a tonne of other tools, just take an old server or workstation and install or if the memory is available use the live version.

3 Spice ups
8

On the note of using Kali and OpenVas I used these videos to get started with doing some scans

9

Ive used Nessus, I really liked it. the license for a year is about what youd pay a company to do a scan 2 times (the first scan to find problems then the next to make sure they were fixed) so if you buy the license for Nessus you can run it all year long if you like.

1 Spice up
10

I didn’t even think to check Kali packages. I haven’t used Kali yet since Backtrack moved over to Kali. But I downloaded the ISO the other day.

11

Hey, i checked out that OpenVAS and it looks pretty cool and straightforward. I think im going to install this on my nagios server and give it a go.

found this tutorial for OpenVAS if anyones interested.

12

Set up an OpenVAS box?

13

Thank you guys for all your help, I ended up using Nessus, and I like it a lot. It was perfect for all our audits.