OpenVAS Vulnerability Assessment

You've locked down your network, patched what you know, and hardened your services — but how do you find the weaknesses you don't know about? Manually checking every port, service, and configuration on a modern fleet is impossible. OpenVAS (Open Vulnerability Assessment System) solves this by automating credentialed and uncredentialed vulnerability scanning, giving you a prioritized list of exploitable weaknesses before an attacker finds them. In this lesson, you'll learn how to use OpenVAS for vulnerability assessment — from installation to a full scan report — and walk away with a repeatable process you can use in any environment.

The problem this lesson solves

Imagine your organization has 200 servers. A new critical CVE drops. Your team manually checks each server for the vulnerable package — that's hours of work, and you'll likely miss something. Even with automated configuration management, you're only checking what you think is installed. The real problem: you don't have a complete, up-to-date inventory of vulnerabilities across your entire attack surface.

Another pain point: false confidence. You patched the known issues, so you assume you're safe. But your web server might be running an outdated TLS version, your database might have default credentials, or a forgotten test service might be exposed. Without regular, automated scanning, these gaps go unnoticed until an attacker exploits them.

OpenVAS addresses this by giving you a free, open-source, and continuously updated vulnerability scanner. It combines a large, community-maintained vulnerability database with a flexible scanning engine, so you can scan your network on demand or on a schedule, and get actionable reports that separate critical issues from noise.

Pro tip: Vulnerability assessment is not a one-time event. It's a continuous process. Regular scans — ideally after every significant change to your infrastructure — keep your security posture accurate.

Core concept / mental model

Think of OpenVAS like an automated security auditor that visits every room in your digital building, checks the locks on every door, tests the strength of every wall, and reports what needs reinforcement. You don't have to inspect every door yourself — the auditor does it quicker and more thoroughly, then hands you a prioritized list of repairs.

Under the hood, OpenVAS works in two phases:

1. Discovery: It scans your target's IP addresses to identify open ports and running services.
2. Attack simulation: For each service found, it matches the service version against a vast database of known vulnerabilities (the Network Vulnerability Tests or NVT feed) and actively probes for weaknesses — sometimes even attempting a safe exploit to confirm the vulnerability.

The result is a scan report that lists vulnerabilities, their severity (from Low to Critical), and recommended fixes. The severity is based on the CVSS (Common Vulnerability Scoring System) — a standard industry rating.

Think of the scanning engine as a mechanic and the NVT feed as the service manual. The engine knows how to test; the feed tells what to test. OpenVAS combines both, and it updates the feed regularly (usually via a cron job) so new CVEs are tested as they're published.

How it works step by step

Installing and running OpenVAS (often called Greenbone Vulnerability Management, or GVM) follows this logical sequence:

1. Install the software — on a dedicated machine (Linux recommended), using your package manager or the official Greenbone installer script.
2. Initialize the environment — set up the databases and generate the TLS certificates that secure the web interface.
3. Update the NVT feed — download the latest vulnerability signatures; this step is essential for accurate results.
4. Start the services — launch the backend processes (gvmd, openvas-scanner, gsad) and the web interface.
5. Log into the web UI — create an admin user and access the Greenbone Security Assistant.
6. Configure a scan — define a target (IP or hostname), optionally provide SSH credentials for a deeper, credentialed scan, and select a scan policy.
7. Launch the scan — OpenVAS runs discovery, probes for vulnerabilities, and produces a report.
8. Review the report — filter the results, prioritize by severity, and start remediation.

Each step builds on the previous, so take your time and verify each stage before moving on.

Pro tip: On older systems, the setup process may take several minutes, especially the feed update. Run updates during off-peak hours to avoid network congestion.

Hands-on walkthrough

Let's get our hands dirty. We'll install OpenVAS on a Debian/Ubuntu system, set it up, run a scan against a test target (like a Metasploitable VM), and interpret the report.

1. Install OpenVAS

OpenVAS isn't in the default Ubuntu repositories, but the Greenbone team provides a PPA. Here's how to install it:

# Add the Greenbone PPA and update
sudo add-apt-repository ppa:mrazavi/gvm
sudo apt update

# Install the full Greenbone Vulnerability Management suite
sudo apt install gvm
# This installs the scanner, manager, and web interface

Note: On Debian, you might use the gvm package available in the official repo. Check your distribution's docs.

2. Initialize and start

After installation, run the setup script. This initializes the database and generates certificates:

# Run the setup script
sudo gvm-setup
# This will take a few minutes, especially the feed update

# Start the services
sudo gvm-start
# Output should confirm each service is running

Check that everything is up:

sudo gvm-check-setup
# Look for 'OK' for every check

3. Log into the web interface

Open a browser at https://127.0.0.1:9392. Accept the self-signed certificate warning. The default credentials are admin and the password printed by gvm-setup (or gvm-check-setup if you missed it).

4. Run a scan

In the Greenbone Security Assistant:

1. Go to Scans → Tasks → New Task.
2. Give it a name like "Scan test server".
3. Under Target, create a new target: enter the IP address of your test machine (e.g., 192.168.1.100).
4. Optionally, under Credentials, add SSH credentials for a credentialed scan (more on that later).
5. Select a Scan Config — for a first pass, use Base or Discovery to keep it quick; Full and fast is good for completeness.
6. Click Save, then click the Play button next to the task to start it.

5. Review the report

Once the scan completes (depends on the target's size and the config), open the Reports tab. You'll see a summary chart like the one below (a simplified example):

+-----------------+------------+--------+----------+------+
| Severity        | Count      |        |          |      |
+-----------------+------------+--------+----------+------+
| Critical        | 12         |        |          |      |
| High            | 25         |        |          |      |
| Medium          | 47         |        |          |      |
| Low             | 33         |        |          |      |
+-----------------+------------+--------+----------+------+

Click on a severity level to drill into the details. Each vulnerability row shows the NVT name, Host, Port, Severity, and a Description with a link to the CVE reference.

Compare options / when to choose what

OpenVAS is powerful, but it's not the only scanner. Here's a quick comparison:

When to choose what:

• OpenVAS if you want a robust, free solution and don't mind managing the setup yourself.
• Nessus if you need a polished UI and can afford a license; it often has better coverage and faster updates.
• Nmap scripts for quick, targeted checks when you don't need a full report.
• Qualys if you're in a regulated industry and need cloud-based scanning with compliance features.

Pro tip: Even if you use a commercial scanner, keep OpenVAS as a second opinion — free, independent verification never hurts.

Troubleshooting & edge cases

Here are common issues you'll hit and how to fix them:

Issue: Feed update fails

ERROR: The VIP has not been synced yet.

This happens when the initial feed sync didn't complete. Re-run:

sudo greenbone-feed-sync --type GVMD_DATA
sudo greenbone-feed-sync --type SCAP
sudo greenbone-feed-sync --type CERT
# Then check setup again
sudo gvm-check-setup

Issue: Web interface not loading

If https://127.0.0.1:9392 doesn't respond, the gsad service might be down. Restart it:

sudo systemctl restart gsad
# Or if using non-systemd:
sudo gvm-stop && sudo gvm-start

Issue: Scan is stuck on "Requested"

Ensure the scanner daemon is running and the target is reachable from the scan machine. Try a quick ping or nmap -p 22 <target> to verify connectivity.

Issue: False positives — you know a vulnerability doesn't apply

OpenVAS may report a vulnerability based on version detection alone. Verify the actual fix status; if the CVE is mitigated by a config change or a backported patch, manually mark it as "False Positive" in the report (right-click the result).

Edge case: Scanning Windows targets

By default, OpenVAS can do uncredentialed scans of Windows machines, but for detailed results (like missing Windows updates), you'll need to provide SMB credentials. Set up a scan config with credential authentication.

What you learned & what's next

You now understand how to use OpenVAS for vulnerability assessment: you can install it, run a scan, interpret the report, and troubleshoot common problems. You've seen how OpenVAS evolves your security posture from reactive patching to proactive discovery.

In this lesson, you learned to:

• Explain the core concept: automated discovery + vulnerability database matching.
• Set up OpenVAS on a Linux host.
• Run both uncredentialed and (optionally) credentialed scans.
• Prioritize vulnerabilities using severity levels (CVSS).

What's next: Now that you can identify vulnerabilities, the next step is learning how to exploit them in a controlled environment — that's Metasploit fundamentals. You'll take the vulnerabilities you found with OpenVAS and use Metasploit to confirm impact, teaching you how attackers operate so you can better defend against them.

Keep practicing: set up a vulnerable target like Metasploitable, scan it, and start remediation. You'll be the one finding flaws before the bad guys do.