Part 2: Conducting a Vulnerability Scan with OpenVAS

Note: OpenVAS, and similar tools, perform vulnerability assessment of Unix, Windows, and network infrastructures and can perform a network discovery of devices, operating systems, applications, databases, and services running on those devices. These tools are typically used to complete the scanning and vulnerability assessment phase of the ethical hacking process once the network mapping scan (that you conducted in Part 1 of this lab) is completed. Conducting a vulnerability scan on entire subnets can be noisy (making them easily detected) and time-consuming. You can limit the breadth and scope of the scan by specifying the hosts you want to scan in a simple text file.

Right-click the vWorkstation desktop and select New > Text Document from the context menu.
Figure 12 Creating the New Text Document

With New Text Document highlighted, type targets and press Enter to rename the new file.
Double-click the targets.txt icon to open the file in the text editor.
In the Notepad window, type the IP addresses discovered by Zenmap. Each IP address should appear on its own line, as shown in the following figure.
Figure 13 Targets.txt file

Click File > Exit, and click Save when prompted to close the text file.
Double-click the OpenVAS icon on the vWorkstation desktop to connect to a remote OpenVAS security scanner.
OpenVAS requires several minutes to initialize. The Internet Explorer window will display a progress bar during this phase.

At Certificate Error warning, click Continue to this website (not recommended) to continue.
When prompted, type the following credentials and click Login to open the application.
· Username: openvasadmin

· Password: pass

If prompted to save your password, click Not for this site to continue.
Figure 14 OpenVAS’s Greenbone Security Assistant

Note: OpenVAS is the scanning engine, but the Greenbone Security Assistance is the Web interface. This interface allows users to quickly scan and analyze their network. In the center of the screen, the assistant points to the Quick start area of the screen. You could type an IP address directly in the box and press Start Scan with no further configuration to create a simple scan of any machine. In the next steps, you will be scanning several IP addresses, the hosts identified by Zenmap, so you will need to configure a report to scan several IP addresses at once.

Select Configuration > Targets from the Greenbone Security Assistant menu to open the Targets page.
Figure 15 Selecting a target

Click the blue star icon in the Targets header to create a new target.
Figure 16 Create a New Target button

In the Name box, type 172.30.0.0, the subnet for this network.
In the Hosts section, click the From file radio button and click Browse.
In the Choose File to Upload window, double-click the targets.txt file to specify the target.
Figure 17 Create an OpenVAS target

Click Create Target to save the target information.
If prompted to use AutoComplete to remember web form entries, click No.
Select Scan Management > New Task from the Greenbone Security Assistant menu.
In the Name box, type Scan 172.30.0.0.
Click the Create Task button to accept the remaining default selections.
Figure 18 Create a new task

If prompted to use AutoComplete to remember web form entries, click No.
The Scan 172.30.0.0 task now appears in the Tasks table on the Greenbone Security Assistant home page.

Click the Start Task button (the green arrow in the Actions column of the table) to begin.
When the scan is completed, the green New button in the Status column of the table will change to a blue Done button. The scan can take as much as 20 minutes to complete. You can manually refresh the page during this time, or set the page to automatically refresh.

Figure 19 Start Task button

In the Tasks header, select Refresh every 10 Sec from the first drop-down menu and click the Set Button (green refresh arrows button) to its right.
Figure 20 Auto-refresh the screen

When the blue Done button appears, click Scan 172.30.0.0 in the Name column of the table to open the scan results.
The Task Details appear at the top of the page followed by the Reports section.

Use the scrollbar to locate the Report section of the page and review the results of the full report. The report has identified several high, medium, and low vulnerabilities.
Click the Details icon (small purple magnifying glass icon) in the Actions column.
Figure 21 Details icon

Click the first Download icon (green down arrow) in the Report Summary section to download the Full Report in a PDF format.
Figure 22 Download icon

When prompted, click the down arrow on the Save button and select Save as from the context menu.
Figure 23 Saving the Vulnerability Scan

In the Save As dialog box, navigate to the Security_Strategies folder (Local Disk (C:) > Security_Strategies), name the report yourname_VulnerabilityScan.pdf, replacing yourname with your own name, and click Save.
When prompted to open the PDF file you just saved, close the IE Download Manager.
Close the Greenbone Security Assistant window.