OpenVAS: The Popular Vulnerability Assessment Tool

Here's a comprehensive guide to how you can use OpenVAS to fix potential security issues before they crop up.

- Arun Santhosh

In an era where organisations gravitate towards new technologies, finding and fixing security weaknesses is mandatory.

The process of identifying potential problems before these can be exploited by attackers is known as vulnerability analysis.

One of the most common open source tools used for this is OpenVAS (Open Vulnerability Assessment System), which is part of the Greenbone Vulnerability Management (GVM) framework. Let's see how we can use this tool effectively.

Installing and accessing OpenVAS

First, we must have Docker on our system. If it's not already installed, let's open a terminal and run the necessary commands to set it up.

$ sudo apt install docker.io

We can now use a single command to download the OpenVAS image and start it as a container.

$ sudo docker run -d -p 443:443 --name openvas mikesplain/openvas

Open a browser window and type https://127.0.0.1 for the login page (as shown in Figure 1). Enter the username as admin and password also as admin. The interface looks like what's shown in Figure 1. We can change the username and password later.

After logging in, the interface looks like what is shown in Figure 2.

Performing a vulnerability scan

To perform a vulnerability scan on a target system to identify potential security vulnerabilities, click on the magic wand icon on the top left. We get the task wizard working as shown in Figure 3. Then we can enter the IP address in the text box. In this demo, I tested for vulnerabilities with two IP addresses -- 172.17.0.1 and a vulnerable public IP address 45.33.32.156. Now click on the Start scan button.

Analysing scan results