Network vulnerability scanning with OpenVAS
You scan a network with Greenbone/OpenVAS, compare authenticated and unauthenticated scans, interpret the results and set up a regular scanning programme that tracks fixes.
Level 201 · 15 lessons · 18 practice labs
Lessons
The scanner
- Scanner architecture: manager, scanner, feed
- Targets and port lists
- Scan configurations: speed, depth, safety
- The first scan and the results view
- Short task: scan the subnet and pick the three most critical findings
Deeper scanning
- Authenticated scanning: over SSH and SMB
- Comparing authenticated and unauthenticated results
- Quality of detection (QoD) and false positives
- Managing findings with overrides and notes
- Short task: reveal five hidden vulnerabilities with an authenticated scan
Programme
- Scheduled scans and notifications
- Delta reports: what closed, what opened
- Exporting findings to the ticketing system
- The impact of scanning on production systems
- Capstone: set up a monthly scanning programme and write the first delta report
Practice labs
- Create a target and scan task for a single server: Define the target and port list, start the scan and show the results arrive.
- Pick the three most critical findings in the scan results: Sort results by severity and quality of detection and write the top three with their solutions.
- Choose a safe scan configuration for a fragile device: Limit the speed and check set for an old print server and show the scan does not take it down.
- Find the service missed because of the port list: Discover the service on a high port not in the default list, extend the list and show the new finding.
- Run an authenticated scan with SSH credentials: Add the scan account’s credential, repeat the scan and show from the report that authentication succeeded.
- Compare authenticated and unauthenticated results: Put the two reports side by side and list the local flaws that appear only in the authenticated scan.
- Verify a low quality-of-detection finding by hand: Check on the server whether a finding with low QoD is real and write the result in a note.
- Find why authentication fails: Notice in the report that authenticated checks did not run, fix the account rights or SMB setting and rescan.
- Write a time-limited, justified override for a false positive: Override the finding for the relevant host and port only and add the justification and end date.
- Set up a weekly scheduled scan with a notification: Schedule the task, define an alert that fires on high-severity findings and show it triggers.
- Show what closed and what opened with a delta report: Produce the delta report between two scans and explain where the new findings came from.
- Turn findings into tickets by owner: Export the report, group findings by server owner and produce one ticket text per group.
- Measure the claim that scanning slows production: Measure the target’s response times during a scan, adjust concurrent checks and show the difference.
- Tune a scan correctly for a network behind a firewall: Find that the alive test treats hosts as dead, change the alive method and port list and compare the two scan results.
- Group findings with one root cause into a single work item: Group a report of 120 findings by solution type, merge those closed by a single package update and state the number of work items.
- Read a finding’s quality-of-detection value and method: Compare the QoD value and detection method of three findings and state which one rests on version information alone.
- Read a scan task’s duration and concurrency settings: Find the task’s start and end time and its settings for concurrent hosts and checks.
- Tune a scan to the maintenance window and low intensity: Move the schedule to the night window, lower concurrent checks and confirm the duration fits the window.
About this course
You scan a network with Greenbone/OpenVAS, compare authenticated and unauthenticated scans, interpret the results and set up a regular scanning programme that tracks fixes.
What you will learn
- The scanner
- Deeper scanning
- Programme
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.