Vulnerability Scanning with OpenVAS and Greenbone

Introduction

Vulnerability scanning identifies known security weaknesses in your systems before attackers do. OpenVAS (Open Vulnerability Assessment System), now part of Greenbone Vulnerability Management (GVM), is the leading open-source vulnerability scanner with 50,000+ Network Vulnerability Tests (NVTs).

Installing GVM (OpenVAS)

Method 1: Docker (Recommended for Quick Start)

BASH

docker pull greenbone/community-edition
docker-compose -f docker-compose-ce.yml up -d

# Access at https://localhost:9392
# Default credentials: admin / admin

Method 2: Native Install on Ubuntu

BASH

# Add Greenbone repository
curl -o /etc/apt/sources.list.d/greenbone.list https://greenbone.github.io/install-packages/greenbone-ce-ubuntu-20.04.list

apt install gvm

# Initialize GVM
gvm-setup
# This downloads NVT feed (~500MB) — takes 20-40 minutes

# Start services
gvm-start

# Check status
gvm-check-setup

First Scan with GVM

Via Web Interface (Greenbone Security Assistant)

Login to https://your-server:9392
Scans → Tasks → New Task
Configure:

Name: "Initial Network Scan"
Scan Config: "Full and Fast"
Target: Add new target with IP ranges

Click Save → Start Task

Via Command Line (gvm-cli)

BASH

# Install CLI client
pip install gvm-tools

# Connect and create target
gvm-cli socket --gvm-socket /run/gvmd/gvmd.sock --xml   "<create_target><name>Internal Network</name><hosts>192.168.1.0/24</hosts></create_target>"

# Create and start task
gvm-cli socket --gvm-socket /run/gvmd/gvmd.sock --xml   "<create_task><name>Full Scan</name><config id='daba56c8-73ec-11df-a475-002264764cea'/><target id='TARGET_ID'/></create_task>"

Understanding Scan Results

Results are categorized by CVSS score:

Severity	CVSS Score	Action
Critical	9.0 - 10.0	Fix immediately
High	7.0 - 8.9	Fix within 24 hours
Medium	4.0 - 6.9	Fix within 30 days
Low	0.1 - 3.9	Fix in next maintenance window
Info	0	Review, informational only

Reading a Vulnerability Report

Example vulnerability output:

TEXT

NVT: Apache HTTP Server Multiple Vulnerabilities (CVE-2023-25690)
Severity: Critical (9.8)
Host: 192.168.1.10
Port: 443/tcp

Summary:
Apache HTTP Server 2.4.0 through 2.4.55 is affected by...

Solution Type: VendorFix
Solution: Update to Apache 2.4.56 or later

Remediation Workflow

BASH

# 1. Export findings as CSV
# GVM: Scans → Reports → Download (CSV format)

# 2. Prioritize by CVSS score
sort -t',' -k5 -rn vulnerabilities.csv | head 20

# 3. Fix critical vulnerabilities
# Example: Update Apache
apt update && apt install apache2

# 4. Re-scan to verify fix
# Run targeted scan on just that host

# 5. Mark as resolved in GVM
# Notes & Overrides → Add Note to suppress confirmed-fixed findings

Scheduled Scanning

BASH

# In GVM: Scans → Schedules → New Schedule
# Set: Run daily at 2am, repeat weekly

# Or via CLI
gvm-cli socket --xml   "<create_schedule>
    <name>Weekly Scan</name>
    <icalendar>DTSTART:20240101T020000Z
RRULE:FREQ=WEEKLY</icalendar>
    <timezone>UTC</timezone>
  </create_schedule>"

Scanning Different Target Types

BASH

# Network scan (most common)
# Target: 192.168.1.0/24

# Single host deep scan
# Target: 192.168.1.10
# Scan config: "Full and very deep"

# Web application scan
# Use "Web Application Tests" scan config
# Target: https://app.company.com

# Authenticated scan (better results, needs credentials)
# In GVM: Credentials → New Credential
# Add SSH username/password for Linux targets
# Add SMB credentials for Windows targets
# Attach credentials to target configuration

Complementary Tools

BASH

# Nmap for quick port discovery (before GVM scan)
nmap -sV -p- --open 192.168.1.0/24 -oN nmap-results.txt

# Nikto for web server scanning
nikto -h http://192.168.1.10

# testssl.sh for SSL/TLS issues
./testssl.sh https://example.com

# Lynis for Linux host hardening audit
apt install lynis
lynis audit system

Summary

Run vulnerability scans regularly — weekly for internet-facing systems, monthly for internal
Use authenticated scans for more accurate results
Prioritize by CVSS score — fix Critical and High first
Always re-scan after patching to confirm the fix
GVM/OpenVAS is excellent open-source; Qualys, Nessus, Rapid7 for enterprise