"
<p>Is the previous tutorial <a href="https://www.hackingtutorials.org/scanning-tutorials/vulnerability-scanning-openvas-9-pt-1/" target="_blank" rel="noopener">Vulnerability Scanning with OpenVAS 9.0 part 1</a> we’ve gone through the installation process of OpenVAS on Kali Linux and the installation of the virtual appliance. In this tutorial we will learn how to configure and run a vulnerability scan. For demonstration purposes we’ve also installed a virtual machine with Metasploitable 2 which we’ll target with OpenVAS. If you don’t know how to install Metasploitable you can check out the installation tutorial for <a href="https://www.hackingtutorials.org/metasploit-tutorials/metasploit-metasploitable-2-installation/" target="_blank" rel="noopener">Metasploitable 2</a> (scroll down a bit) or <a href="https://www.hackingtutorials.org/metasploit-tutorials/setup-metasploitable-3-windows-10/" target="_blank" rel="noopener">Metasploitable 3</a>.</p>
<p>Before we can actually start vulnerability scanning with OpenVAS 9, we have to complete the following tasks:</p>
<ol>
   <li>Create and configure a target.</li>
   <li>Create and configure a scan task.</li>
   <li>Run the scan.</li>
</ol>
<p>At this point of the tutorial you need to have OpenVAS 9.0 installed and configured. If you haven&#8217;t done this at this point I recommend to follow <a href="https://www.hackingtutorials.org/scanning-tutorials/vulnerability-scanning-openvas-9-pt-1/" target="_blank" rel="noopener">part 1 of vulnerability scanning with OpenVAS</a> first. To follow along it is also recommended to have a vulnerable Metasploitable machine up and running that is accessible from the OpenVAS appliance or the Kali Linux VM you’ve installed OpenVAS on. The lab setup used for this tutorial looks as follows:</p>
<ul>
   <li>Host machine with VMWare Workstation Pro 12.</li>
   <li>Kali Linux 2018.2 VM with OpenVAS 9.0 installed (192.168.65.128).</li>
   <li>Metasploitable 2 VM (192.168.65.137).</li>
</ul>
<p>All virtual machines use the NAT network which can be configured in the network settings on the network adapter. Now that we’ve got everything up and running, let’s start with configuring a target and a scan task.</p>
<p>
   <span style="display: inline !important; float: none; background-color: transparent; color: #606569; cursor: text; font-family: 'Open Sans',Arial,sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;">
<div class="cfmon"> <!-- Hackingtutorials.org InPost - RES --> <ins class="adsbygoogle" style="display:block" data-ad-client="ca-pub-2195678332656815" data-ad-slot="1208678084" data-ad-format="auto"></ins> <script> (adsbygoogle = window.adsbygoogle || []).push({}); </script></div></span></p>
<blockquote>
   <p><strong>Tip</strong>: Did you forgot to write down or change your OpenVAS admin password? Check out the installation tutorial to find out how to reset the admin password.</p>
</blockquote>
<h3>Vulnerability Scanning with OpenVAS 9 Tutorials</h3>
<ul>
   <li><a title="Vulnerability Scanning with OpenVAS 9 part 1: Installation &amp; Setup" href="https://www.hackingtutorials.org/scanning-tutorials/vulnerability-scanning-openvas-9-pt-1/">Vulnerability Scanning with OpenVAS 9 part 1: Installation &amp; Setup</a></li>
   <li><a title="Vulnerability Scanning with OpenVAS 9 part 2: Vulnerability Scanning" href="https://www.hackingtutorials.org/scanning-tutorials/vulnerability-scanning-openvas-9-0-part-2/">Vulnerability Scanning with OpenVAS 9 part 2: Vulnerability Scanning</a></li>
   <li><a href="https://www.hackingtutorials.org/scanning-tutorials/vulnerability-scanning-with-openvas-9-scanning-the-network/" target="_blank" rel="noopener">Vulnerability Scanning with OpenVAS 9 part 3: Scanning the Network</a></li>
   <li><a href="https://www.hackingtutorials.org/scanning-tutorials/openvas-9-part-4-custom-scan-configurations/">Vulnerability Scanning with OpenVAS 9 part 4: Custom scan configurations</a></li>
</ul>
<h2>1 Creating a target in OpenVAS</h2>
<p>The first step is to create and configure a target using the OpenVAS/Greenbone Security Assistant web interface. This newly created target is selected in the following step where we configure a scanning task.</p>
<p>To create a target, we need to follow 2 steps:</p>
<ol>
   <li>Go to ‘Configuration’ in the top menu and select ’Targets’.</li>
   <li>Click the blue icon in the top left corner to create a new target.</li>
</ol>
<div id="attachment_2312" style="width: 976px" class="wp-caption alignnone">
   <img class="wp-image-2312 size-full" src="https://www.hackingtutorials.org/wp-content/uploads/2018/05/01-Create-a-target-1.jpg" alt="Vulnerability scanning" width="966" height="270" srcset="https://www.hackingtutorials.org/wp-content/uploads/2018/05/01-Create-a-target-1.jpg 966w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/01-Create-a-target-1-150x42.jpg 150w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/01-Create-a-target-1-300x84.jpg 300w" sizes="(max-width: 966px) 100vw, 966px" />
   <p class="wp-caption-text">Click configuration and then new target.</p>
</div>
<p>After hitting the new target button, a dialog screen appears where we have to enter the following information:</p>
<ol>
   <li>Target name, we’ll name it Metasploitable 2.</li>
   <li>The target IP host which is the IP address for our Metasploitable 2 lab machine.</li>
</ol>
<p>Keep all other settings default and click the ‘Create’ button.</p>
<div id="attachment_2313" style="width: 730px" class="wp-caption alignnone">
   <img class="wp-image-2313 size-full" src="https://www.hackingtutorials.org/wp-content/uploads/2018/05/02-Create-a-target-2.jpg" alt="02 Create a target-2" width="720" height="441" srcset="https://www.hackingtutorials.org/wp-content/uploads/2018/05/02-Create-a-target-2.jpg 720w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/02-Create-a-target-2-150x92.jpg 150w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/02-Create-a-target-2-300x184.jpg 300w" sizes="(max-width: 720px) 100vw, 720px" />
   <p class="wp-caption-text">Enter the target name, IP and click create.</p>
</div>
<p>The newly created target will now appear in the list of available targets:</p>
<div id="attachment_2314" style="width: 977px" class="wp-caption alignnone">
   <img class="wp-image-2314 size-full" src="https://www.hackingtutorials.org/wp-content/uploads/2018/05/03-Create-a-target-3.jpg" alt="03 Create a target-3" width="967" height="357" srcset="https://www.hackingtutorials.org/wp-content/uploads/2018/05/03-Create-a-target-3.jpg 967w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/03-Create-a-target-3-150x55.jpg 150w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/03-Create-a-target-3-300x111.jpg 300w" sizes="(max-width: 967px) 100vw, 967px" />
   <p class="wp-caption-text">Newly created target.</p>
</div>
<p>Now that we’ve got our target all set up, let’s continue with creating a scan task that will scan the Metasploitable 2 target for vulnerabilities.</p>
<h2>2 Configuring a scanning task in OpenVAS</h2>
<p>In this section of the tutorial we will create a new scanning task. A scanning task defines which targets will be scanned and also the scanning options such as a schedule, scanning configuration and concurrently scanned targets and NVTs per host. In this tutorial we will just create a scan task and use default scan configurations. In Vulnerability Scanning with OpenVAS 9.0 part 3 (Will be published on: May 25 2018) we will have a more detailed look into scanning configurations.</p>
<p>To create a new scan task, we have to perform the following steps:</p>
<ol>
   <li>Go to ‘Scans’ in the top menu and select ’Tasks’.</li>
   <li>Point to the blue icon in the top left corner and select ‘New Task’.</li>
</ol>
<div id="attachment_2315" style="width: 977px" class="wp-caption alignnone">
   <img class="wp-image-2315 size-full" src="https://www.hackingtutorials.org/wp-content/uploads/2018/05/04-Create-a-scan-task-1.jpg" alt="04 Create a scan task-1" width="967" height="260" srcset="https://www.hackingtutorials.org/wp-content/uploads/2018/05/04-Create-a-scan-task-1.jpg 967w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/04-Create-a-scan-task-1-150x40.jpg 150w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/04-Create-a-scan-task-1-300x81.jpg 300w" sizes="(max-width: 967px) 100vw, 967px" />
   <p class="wp-caption-text">Click scans -&gt; Tasks and then new task.</p>
</div>
<p>After clicking the new scan option, a dialog screen appears where we have to enter the following information:</p>
<ol>
   <li>Task name, we’ll name it ‘Scan Metasploitable 2’.</li>
   <li>Make sure that the Metasploitable 2 target we’ve created earlier is selected.</li>
   <li>Tick the schedule once checkbox.</li>
   <li>Keep all other settings default and click the ‘Create’ button to create the new task.</li>
</ol>
<div id="attachment_2316" style="width: 730px" class="wp-caption alignnone">
   <img class="wp-image-2316 size-full" src="https://www.hackingtutorials.org/wp-content/uploads/2018/05/05-Create-a-scan-task-2.jpg" alt="05 Create a scan task-2" width="720" height="439" srcset="https://www.hackingtutorials.org/wp-content/uploads/2018/05/05-Create-a-scan-task-2.jpg 720w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/05-Create-a-scan-task-2-150x91.jpg 150w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/05-Create-a-scan-task-2-300x183.jpg 300w" sizes="(max-width: 720px) 100vw, 720px" />
   <p class="wp-caption-text">Enter the task name, target and schedule the task only once.</p>
</div>
<p>The newly created task will now appear in the task list as follows:</p>
<div id="attachment_2317" style="width: 970px" class="wp-caption alignnone">
   <img class="wp-image-2317 size-full" src="https://www.hackingtutorials.org/wp-content/uploads/2018/05/06-Create-a-scan-task-3.jpg" alt="06 Create a scan task-3" width="960" height="141" srcset="https://www.hackingtutorials.org/wp-content/uploads/2018/05/06-Create-a-scan-task-3.jpg 960w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/06-Create-a-scan-task-3-150x22.jpg 150w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/06-Create-a-scan-task-3-300x44.jpg 300w" sizes="(max-width: 960px) 100vw, 960px" />
   <p class="wp-caption-text">Newly created scan task.</p>
</div>
<p>There’s also a few other options to create scan tasks. We can use the scan task wizard to instantly scan a target and also the advanced scan task wizard which gives a few more options to configure. For demonstration purposes we’ll stick with the task we’ve just created.</p>
<p>Now that we’ve configured the scan task and added the Metasploitable 2 machine to the target list, all that remains is to run the task and wait for the results.</p>
<h2>3 Running the OpenVAS vulnerability scan</h2>
<p>To run the newly created task we just have to click the green start button as follows:</p>
<div id="attachment_2318" style="width: 970px" class="wp-caption alignnone">
   <img class="wp-image-2318 size-full" src="https://www.hackingtutorials.org/wp-content/uploads/2018/05/07-Run-scan-task-1.jpg" alt="" width="960" height="141" srcset="https://www.hackingtutorials.org/wp-content/uploads/2018/05/07-Run-scan-task-1.jpg 960w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/07-Run-scan-task-1-150x22.jpg 150w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/07-Run-scan-task-1-300x44.jpg 300w" sizes="(max-width: 960px) 100vw, 960px" />
   <p class="wp-caption-text">Run the scan task.</p>
</div>
<p>The scan task will now execute against the selected target. Please note that full scan may take a while to complete. When you refresh the tasks page you will be able to check the progress for the executed task:</p>
<ol>
   <li>Reload the page.</li>
   <li>Check task status/progress.</li>
</ol>
<div id="attachment_2319" style="width: 972px" class="wp-caption alignnone">
   <img class="wp-image-2319 size-full" src="https://www.hackingtutorials.org/wp-content/uploads/2018/05/08-Run-scan-task-2.jpg" alt="08 Run scan task-2" width="962" height="597" srcset="https://www.hackingtutorials.org/wp-content/uploads/2018/05/08-Run-scan-task-2.jpg 962w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/08-Run-scan-task-2-150x93.jpg 150w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/08-Run-scan-task-2-300x186.jpg 300w" sizes="(max-width: 962px) 100vw, 962px" />
   <p class="wp-caption-text">Vulnerability scan in progress&#8230;</p>
</div>
<p>After waiting a while the scan task is finished and the status changes to ‘Done’:</p>
<div id="attachment_2320" style="width: 966px" class="wp-caption alignnone">
   <img class="wp-image-2320 size-full" src="https://www.hackingtutorials.org/wp-content/uploads/2018/05/09-Run-scan-task-3.jpg" alt="Vulnerability scan finished" width="956" height="468" srcset="https://www.hackingtutorials.org/wp-content/uploads/2018/05/09-Run-scan-task-3.jpg 956w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/09-Run-scan-task-3-150x73.jpg 150w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/09-Run-scan-task-3-300x147.jpg 300w" sizes="(max-width: 956px) 100vw, 956px" />
   <p class="wp-caption-text">Vulnerability scan finished</p>
</div>
<p>As expected we can see that OpenVAS found a number of severe vulnerabilities. Let’s have a look at the details of the results.</p>
<h2>4 Interpreting the scan results</h2>
<p>Now that the vulnerability scan is finished we can browse to ‘Scans -&gt; Reports’ in the top menu. On the reports page we can find the report for the completed scanning task:</p>
<div id="attachment_2321" style="width: 975px" class="wp-caption alignnone">
   <img class="wp-image-2321 size-full" src="https://www.hackingtutorials.org/wp-content/uploads/2018/05/10-reports-1.jpg" alt="Vulnerability scanning report" width="965" height="609" srcset="https://www.hackingtutorials.org/wp-content/uploads/2018/05/10-reports-1.jpg 965w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/10-reports-1-150x95.jpg 150w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/10-reports-1-300x189.jpg 300w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/10-reports-1-343x215.jpg 343w" sizes="(max-width: 965px) 100vw, 965px" />
   <p class="wp-caption-text">Vulnerability scanning report</p>
</div>
<p>By clicking the report name we can get an overview of all discovered vulnerabilities on the Metasploitable 2 machine, which is a lot as already expected. The results are ordered on severity rate by default:</p>
<div id="attachment_2322" style="width: 971px" class="wp-caption alignnone">
   <img class="wp-image-2322 size-full" src="https://www.hackingtutorials.org/wp-content/uploads/2018/05/11-reports-2.jpg" alt="Discovered vulnerabilities." width="961" height="608" srcset="https://www.hackingtutorials.org/wp-content/uploads/2018/05/11-reports-2.jpg 961w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/11-reports-2-150x95.jpg 150w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/11-reports-2-300x190.jpg 300w" sizes="(max-width: 961px) 100vw, 961px" />
   <p class="wp-caption-text">Discovered vulnerabilities.</p>
</div>
<p>When we click on the vulnerability name we can get an overview of the details regarding the vulnerability. The following details apply to a backdoor vulnerability in Unreal IRCD we’ve covered in an earlier tutorial:</p>
<div id="attachment_2323" style="width: 970px" class="wp-caption alignnone">
   <img class="wp-image-2323 size-full" src="https://www.hackingtutorials.org/wp-content/uploads/2018/05/12-reports-3.jpg" alt="Vulnerability details" width="960" height="613" srcset="https://www.hackingtutorials.org/wp-content/uploads/2018/05/12-reports-3.jpg 960w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/12-reports-3-150x96.jpg 150w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/12-reports-3-300x192.jpg 300w" sizes="(max-width: 960px) 100vw, 960px" />
   <p class="wp-caption-text">Vulnerability details.</p>
</div>
<p>Finally, we can also export the report in a variety of formats, such as: XML, HTML and PDF. WE can do this by selecting the desired format from the drop-down menu and click the green export icon as follows:</p>
<div id="attachment_2324" style="width: 974px" class="wp-caption alignnone">
   <img class="wp-image-2324 size-full" src="https://www.hackingtutorials.org/wp-content/uploads/2018/05/13-reports-4.jpg" alt="Export vulnerability report to PDF" width="964" height="341" srcset="https://www.hackingtutorials.org/wp-content/uploads/2018/05/13-reports-4.jpg 964w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/13-reports-4-150x53.jpg 150w, https://www.hackingtutorials.org/wp-content/uploads/2018/05/13-reports-4-300x106.jpg 300w" sizes="(max-width: 964px) 100vw, 964px" />
   <p class="wp-caption-text">Export vulnerability report to PDF.</p>
</div>
<p>For now, this will conclude part 2 of the vulnerability scanning with OpenVAS tutorial. In the next and final part, we will be focusing on custom scanning configurations to fine tune our scanning needs. Part 3 of vulnerability scanning with OpenVAS will be published on May 25.</p>
<a target='new' rel="nofollow" href="https://www.virtualhackinglabs.com/?utm_source=ht&utm_medium=postbanner&utm_campaign=ht"><IMG border="0" alt="Virtual Hacking Labs - Penetration testing lab" src="https://www.hackingtutorials.org/wp-content/uploads/2017/05/6.jpg"></a>"