The Nessus Attack Scripting Language, usually referred to as NASL, is a

scripting language A scripting language or script language is a programming language that is used to manipulate, customize, and automate the facilities of an existing system. Scripting languages are usually interpreted at runtime rather than compiled. A scripti ...

that is used by

vulnerability scanner A vulnerability scanner is a computer program designed to assess computers, networks or applications for known weaknesses. These scanners are used to discover the weaknesses of a given system. They are utilized in the identification and detecti ...

s like Nessus and

OpenVAS OpenVAS (''Open Vulnerability Assessment System'', originally known as ''GNessUs'') is the scanner component of Greenbone Vulnerability Manager (GVM), a software framework of several services and tools offering vulnerability scanning and vulnerab ...

. With NASL specific attacks can be automated, based on known

vulnerabilities Vulnerability refers to "the quality or state of being exposed to the possibility of being attacked or harmed, either physically or emotionally." A window of vulnerability (WOV) is a time frame within which defensive measures are diminished, com ...

. Tens of thousands of plugins have been written in NASL for Nessus and OpenVAS. Files that are written in this language usually get the file extension .nasl. For the exploitation of a

zero day attack A zero-day (also known as a 0-day) is a computer-software vulnerability previously unknown to those who should be interested in its mitigation, like the vendor of the target software. Until the vulnerability is mitigated, hackers can exploit it t ...

it is possible for an end user of Nessus or OpenVAS to write custom code in NASL which is executed by these vulnerability scanners. In earlier versions of Nessus, a binary called nasl or nasl.exe was provided that could interpret NASL code to perform vulnerability scans. In later versions of Nessus, this should be done via an

API An application programming interface (API) is a way for two or more computer programs to communicate with each other. It is a type of software interface, offering a service to other pieces of software. A document or standard that describes how ...

that is provided by this software. An example of executing a NASL plugin 'myzeroday.nasl' on Windows, a command such as the following could be invoked: An equivalent example of a Linux or UNIX command could look like this: If the plugin, in this example myzeroday.nasl, is placed in the same directory where other NASL plugins are located, it can also be included in standard scans by Nessus or OpenVAS, via the Web GUI or an API. Many of the specifications of the formal language are similar to those of the programming language C and the scripting language Perl and those of other languages.

Control flow In computer science, control flow (or flow of control) is the order in which individual statements, instructions or function calls of an imperative program are executed or evaluated. The emphasis on explicit control flow distinguishes an '' ...

such as the for loop, the if and if-else statements are part of the language and comments are preceded by a hash. An example of "Hello World" in NASL is: In the release notes of Nessus 6.10.0 of 1/31/2017, a new NASL compiler for faster plugins was mentioned.https://docs.tenable.com/releasenotes/nessus/nessus50.htm Nessus 6.10.0 Release Notes - 1/31/2017, New NASL compiler for faster plugins

References

Sources

*Nessus Network Auditing, 2nd Edition by Russ Rogers, Publisher: Syngress Release Date: October 2011 Chapter 11 NASL
Using the 'nasl' Nessus Command Line ToolAdding third party nasl plugins to OpenVAS by Alexander V. Leonov Information Security AutomationFreeBSD Manual Pages, Manual Reference Pages - OPENVAS-NASL (1)
*Nessus, Snort, and Ethereal Power Tools, by Noam Rathaus, Gilbert Ramirez, Jay Beale, Brian Caswell, Publisher: Syngress 2005 {{ISBN, 9780080489421 Chapter 1. The Inner Workings of NASL (Nessus Attack Scripting Language) Scripting languages Pentesting software toolkits Software testing tools Free security software