Scanning Capabilities of Nessus, Qualys and OpenVAS Vulnerability Scanner Tools for Vulnerable Operating Systems and Web Applications

Web applications, which serve as the primary interface between users and organizational systems, represent a particularly critical attack surface that requires specialized attention to ensure their security. Common web application vulnerabilities, such as SQL injection, cross-site scripting (XSS), and insecure authentication mechanisms, can provide attackers with direct access to sensitive data and backend systems. Therefore, it is crucial for vulnerability scanning tools to effectively detect and report web application security flaws. Vulnerability scanning tools are widely used to detect risks in the software and hardware used in information systems. However, owing to the variety of software and hardware used in information systems, vulnerability scanning and detection tools have very different capabilities. These differences in capabilities make it difficult to compare the vulnerability scanning tools. In this study, after determining the necessary comparison criteria for general information system and web application vulnerability detection, the widely used Nessus, Qualys, and OpenVAS vulnerability scanning tools were examined. The results were compared by running the vulnerability scanning tools on operating systems and web applications known to contain vulnerabilities.