Type to search…
Skip to content

OpenVAS

A vulnerability scanner doesn't look for open ports but for known holes - deploy Greenbone and turn its report into a risk analysis.

Taught in
Seguretat i alta disponibilitatSeguretatASIX

Introduction

In Nmap you discovered that a server has port 22 open and that the service is OpenSSH 8.2p1.

This is as far as nmap goes: it tells you what’s there.

What it doesn’t tell you is whether that specific version has any known holes, which one, and how severe it is.

This second question has an answer because the holes get published.

Every known vulnerability has a CVE identifier (CVE-2014-0160) and a CVSS score from 0 to 10.

A vulnerability scanner is the program that cross-references the two lists: what it finds on your network and the public catalog of holes.

OpenVAS is Greenbone’s scanning engine, and it’s the best known of the free ones.

Work environment

Create two Ubuntu 24.04 Server virtual machines in Desktop:

NameWhat for
greenbonethe scanner — 4 CPU and 8 GB of RAM
victimthe machine you’ll scan

Both must be on the same network so they can see each other.

The scanner

Greenbone is distributed as a set of containers, and you’ll start them all with docker compose.

You don’t need to understand the file here: it’s given to you ready-made, and you just have to start it.

On the greenbone machine, download the official compose.yaml:

shell
mkdir greenbone && cd greenbone
curl -f -O -L https://greenbone.github.io/docs/latest/_static/compose.yaml

Take a look at it before starting it: you’ll find a good dozen services.

shell
grep "image:" compose.yaml

It’s worth understanding why there are so many, because it explains how the product works:

ServiceWhat it does
openvas-scannerthe engine that runs the tests
gvmdthe manager: maintains targets, tasks, and reports
gsa / gsadthe web interface
pg-gvmthe PostgreSQL database
vulnerability-tests, scap-data, cert-bund-datathe vulnerability catalogs

The last three are the real product.

The scan engine doesn’t know anything by itself: what it knows are the tens of thousands of tests that come with the feed.

Download the images and start everything:

shell
docker compose -f compose.yaml pull
docker compose -f compose.yaml up -d

Keep reading — it's free.

The rest of this page is open to anyone with a free account. Nothing is sold here and nothing is charged for: the account exists so we know who agreed to the terms, and so we can send you the newsletter if you want it.

Create a free account

You will be asked to accept the Terms · Privacy Policy