OpenVAS

OpenVAS, an application used to scan endpoints and web applications to identify and detect vulnerabilities. It is commonly used by corporations as part of their mitigation solutions to quickly identify any gaps in their production or even development servers or applications. This is not an end all be all solution but can help to get rid of any common vulnerabilities that may have slipped through the cracks.

From the OpenVAS GitHub repository "This is the Open Vulnerability Assessment Scanner (OpenVAS) of the Greenbone Vulnerability Management (GVM) Solution. It is used for the Greenbone Security Manager appliances and is a full-featured scan engine that executes a continuously updated and extended feed of Network Vulnerability Tests (NVTs)."

Understanding OpenVAS & GVM Architecture

Before jumping into scanning targets with OpenVAS, it is crucial to understand how it works under the hood.

OpenVAS isn't just a single isolated tool — it is part of a larger framework called Greenbone Vulnerability Management (GVM). To make this architecture simple and easy to digest, we can break it down into three main building blocks:

The 3 Main Components of GVM

1. Front-End (What You See)

• Components: Greenbone Security Assistant (GSA), Web Browser, GMP Clients.
• In Simple Terms: This is the dashboard/user interface. When you open OpenVAS in your browser, you are interacting with the front-end. It allows you to create tasks, launch scans, and view report results visually without messing with complex backend commands.

2. Back-End

• Components: OpenVAS Scanner, OSP Scanner, Greenbone Vulnerability Manager, Target Systems.
• In Simple Terms: This is where the actual heavy lifting happens. The OpenVAS Scanner reaches out over the network to send probes to the target machines. The Greenbone Vulnerability Manager acts as the middleman — taking orders from your front-end web browser, sending them to the scanners, and processing the results back.

3. Vulnerability / Information Feed

• Components: NVT (Network Vulnerability Tests), SCAP CERT, Community Feed, User Data.
• In Simple Terms: A scanner is useless if it doesn't know what vulnerabilities to look for. This feed acts as the scanner's knowledge base. It constantly updates OpenVAS with the latest vulnerability signatures (NVTs) from the Greenbone Community Feed so it knows how to test for new threats.

Summary Workflow

1. You set up a scan via the Front-End (Web UI).
2. The Back-End (Manager & OpenVAS Scanner) grabs the latest tests from the Feed.
3. The Scanner tests the Target System, collects the findings, and passes them back to your browser screen

Installing OpenVAS

Now that we understand the architecture, it is time to set up our OpenVAS environment.

Important Note:_ OpenVAS is not meant to be installed directly on the TryHackMe AttackBox._

Step-by-Step Walkthrough (Docker Method)

Step 1: Install Docker

First, ensure Docker is installed on your Linux system:

apt install docker.io

apt install docker.io

Step 2: Pull and Run the OpenVAS Docker Container

Execute the following single command to pull the pre-built image and launch OpenVAS on port 443:

sudo docker run -d -p 443:443 --name openvas mikesplain/openvas

sudo docker run -d -p 443:443 --name openvas mikesplain/openvas

Docker will download all required layers and spin up the container automatically. Give it a few minutes to complete initial boot-up tasks.

Step 3: Access the Web Interface

Once running, open your web browser and navigate to:

https://127.0.0.1

https://127.0.0.1

Step 4: Login with Default Credentials

Use the default administrator credentials to access the Greenbone Security Assistant dashboard:

• Username: admin
• password: admin

Once logged in, you will be greeted by the Dashboard displaying NVTs, CVE statistics, and task overviews.

Initial Configuration & First Scan

Before deploying OpenVAS to scan external network assets, we need to perform an initial test scan against our localhost (127.0.0.1) to confirm that the setup, scanner engines, and feed database are functioning correctly.

Step-by-Step Initial Setup

1. Launch the Task Wizard:

• Open the OpenVAS web interface (Greenbone Security Assistant).
• Navigate to Scans ➔ Tasks from the top navigation bar.
• Click on the purple magic wand icon in the top-left corner to launch the Task Wizard.

1. Configure the Local Scan:

• Enter 127.0.0.1 (or your loopback IP) into the IP address/hostname field.
• Click Start Scan.

1. Monitor Scan Progress:

• OpenVAS automatically creates a new Target, creates a Task, and begins scanning immediately.
• You can monitor progress under Scans ➔ Tasks. Reload the page periodically until the status changes to Done (100%).

1. Review the Results:

• Go to Scans ➔ Reports and click on the generated report.
• You will typically see default configuration findings related to OpenVAS services themselves (such as default HTTP/SSL certificates or default service banners). This verifies the scanner is operating correctly.

Scanning Infrastructure (Scanning Remote Targets)

Now that we have verified OpenVAS is functioning properly with a local scan, we can move on to real-world infrastructure scanning. In this section, we will deploy a remote target machine (DVWA) and configure a custom scanning task from scratch instead of relying on the quick wizard.

Step 1: Deploying the Lab Machine

1. Click the Start Lab Machine button on TryHackMe to spin up the target server.
2. Note down the provided IP address (e.g., 10.10.147.246).

Step 2: Scoping a New Target

Before creating a scan task, OpenVAS requires you to define a Target:

1. Navigate to Configuration ➔ Targets (or click the star icon next to Scan Targets inside the task menu).
2. Click the New Target icon (blue icon with a white star/page).
3. Configure the fields:

• Name: DVWA (or any descriptive name)
• Hosts: Select Manual and type the Target IP (e.g., 10.10.147.246).

Click Create to save the target configuration.

Step 3: Creating and Configuring a Task

Now we attach our newly created target to an actual scanning job:

1. Navigate to Scans ➔ Tasks.
2. Hover over the star icon in the upper-left corner and select New Task.
3. Fill out the core task parameter options:

• Name: Set a label for the task (e.g., DVWA Vulnerability Assessment).
• Scan Targets: Select the DVWA target we created in Step 2.
• Scanner: Keep as default (OpenVAS Default).
• Scan Config: Select Full and Fast (a balanced profile that tests common NVTs efficiently).

Click Create

Step 4: Executing & Reviewing the Scan

1. Locate your new task in the Tasks dashboard.
2. Under the Actions column on the right, click the Green Play/Start Button to initiate the scan.
3. Monitor the progress bar until the status displays Done (100%).
4. Click on Scans ➔ Reports and open the report to review discovered security flaws (such as missing HttpOnly cookie flags, cleartext transmission over HTTP, and SSH algorithms supported).

Reporting & Continuous Monitoring

A crucial aspect of vulnerability management is not just running scans, but efficiently analyzing reports and automating routine assessments. OpenVAS provides robust capabilities for reporting, scheduled scanning, and automated alerts.

1. Breaking Down OpenVAS Reports

When a scan completes, OpenVAS generates a comprehensive report categorized into structured sections:

• Host Summary: Provides an overview of scanned hosts, start/end times, and the count of discovered vulnerabilities divided by severity (High, Medium, Low, Log).
• Port Summary: Lists open ports and services running on the host alongside their respective risk levels.
• Vulnerability Details: Offers a deep dive into each finding, including:
• NVT Name & OID: The specific vulnerability test identifier.
• Summary & Impact: Description of the threat (e.g., OS End of Life Detection).
• Solution: Practical mitigation or patching guidance to remediate the flaw.

2. Creating Schedules for Automated Scans

In production environments, vulnerability scans should run periodically (e.g., weekly or monthly) rather than manually.

How to Create a Schedule:

1. Navigate to Configuration ➔ Schedules.
2. Click the New Schedule icon (blue star).
3. Configure:

• Name: Descriptive label (e.g., Weekly Infrastructure Scan).
• First Start Time: Date and time for the initial run.
• Period: Frequency of the scan (e.g., every 7 days).

1. Save the schedule and attach it to a task under Scans ➔ Tasks ➔ Schedule.

3. Crafting Automated Alerts

Security teams need immediate notifications when high-severity vulnerabilities are detected or when a scan finishes.

How to Configure an Alert:

1. Navigate to Configuration ➔ Alerts.
2. Click the New Alert icon (blue star).
3. Configure the trigger logic:

• Event: Select trigger conditions (e.g., Task run status changed to Done).
• Condition: Filter by severity threshold (e.g., Severity at least 7.0).
• Method: Choose notification mechanism (e.g., Email, Syslog, or HTTP Get).
• To Address: Specify the destination email for security alerts.

4.Attach the created alert to your desired scanning task under the task settings.

1. When did the scan start in Case 001?

Feb 28, 00:04:46

2. When did the scan end in Case 001?

Feb 28, 00:21:02

3. How many ports are open in Case 001?

3

4. How many total vulnerabilities were found in Case 001?

5

5. What is the highest severity vulnerability found? (MSxx-xxx)

MS17–010

6. What is the first affected OS to this vulnerability?

Microsoft Windows 10 x32/x64 Edition

7. What is the recommended vulnerability detection method?

Send the crafted SMB transaction request with fid = 0 and check the response to confirm the vulnerabilit

Conclusion

Want to learn more? There are many guides and blogs out on OpenVAS and GVM highlighting various advanced topics and features of the platforms. You can get a lot of information and technical understanding from the Greenbone technologies manual portal and forums.