OpenVAS
A vulnerability scanner doesn't look for open ports but for known holes - deploy Greenbone and turn its report into a risk analysis.
Introduction
In Nmap you discovered that a server has port 22 open and that the service is OpenSSH 8.2p1.
This is as far as nmap goes: it tells you what’s there.
What it doesn’t tell you is whether that specific version has any known holes, which one, and how severe it is.
This second question has an answer because the holes get published.
Every known vulnerability has a CVE identifier (CVE-2014-0160) and a CVSS score from 0 to 10.
A vulnerability scanner is the program that cross-references the two lists: what it finds on your network and the public catalog of holes.
OpenVAS is Greenbone’s scanning engine, and it’s the best known of the free ones.
Work environment
Create two Ubuntu 24.04 Server virtual machines in Desktop:
| Name | What for |
|---|---|
greenbone | the scanner — 4 CPU and 8 GB of RAM |
victim | the machine you’ll scan |
Both must be on the same network so they can see each other.
The scanner
Greenbone is distributed as a set of containers, and you’ll start them all with docker compose.
You don’t need to understand the file here: it’s given to you ready-made, and you just have to start it.
On the greenbone machine, download the official compose.yaml:
&&
Take a look at it before starting it: you’ll find a good dozen services.
It’s worth understanding why there are so many, because it explains how the product works:
| Service | What it does |
|---|---|
openvas-scanner | the engine that runs the tests |
gvmd | the manager: maintains targets, tasks, and reports |
gsa / gsad | the web interface |
pg-gvm | the PostgreSQL database |
vulnerability-tests, scap-data, cert-bund-data | the vulnerability catalogs |
The last three are the real product.
The scan engine doesn’t know anything by itself: what it knows are the tens of thousands of tests that come with the feed.
Download the images and start everything:
Keep reading — it's free.
The rest of this page is open to anyone with a free account. Nothing is sold here and nothing is charged for: the account exists so we know who agreed to the terms, and so we can send you the newsletter if you want it.
Create a free accountYou will be asked to accept the Terms · Privacy Policy