How to Perform a Large-Scale Network Security Audit with OpenVAS's GSA « Null Byte :: WonderHowTo

In my previous article, I discussedinstalling and configuring OpenVAS on Kali Linux. Now it's time to start using OpenVAS with the Greenbone Security Assistant to audit networks for security issues. This can be extremely helpful when you are looking for vulnerabilities or misconfigurations in a large number of hosts.When dealing with any form of mass scanning utility, there are some drawbacks. This type of scanning is noisy. In this context, "noisy" means active scans are being conducted which may be logged or detected. If you want to keep your presence a secret, this is not the tool to use. This type of scanning is also prone to false positives. You will need to confirm that what the tool is reporting is correct before taking it as an absolute fact.With that said, let's have a look at the Greenbone Security Assistant, a web-based GUI for OpenVAS. If you installed and configured OpenVAS and GSA to operate on a headless machine, you can access it at https://YourMachineAddress:9392 . If you configured it to operate locally, you can access it athttps://127.0.0.1:9392.You may also need to bring the associated services up with the commandopenvas-start. You will need to log in with "admin" as the username. The password for the admin account is generated during the setup process for OpenVAS. If you haven't runopenvas-setup, see my previous article linked below.Previously:How to Install OpenVAS for Broad Vulnerability AssessmentAfter logging in, you will be presented with the Greenbone dashboard.Step 1: Use the Automated Task Wizard to Scan for VulnerabilitiesGSA's Task Wizard is the easiest way to get up and running with scanning. It requires very little setup and has sane defaults to get started quickly. When we first access GSA, we are presented with the dashboard which gives us some statistics related to our usage.On the first run, there's not a lot going on. Let's start by running a scan against my Metasploitable 2 virtual machine (VM). Before we start the scan, I'd like to talk a little bit about Metasploitable 2.Metasploitable 2 is an intentionally vulnerable Linux distribution. It allows testing of vulnerability assessment tools in a safe and, most importantly, legal environment. The version of Metasploitable that I am using is not the most recent version. Running a modern, up-to-date vulnerability scanner like GSA against it should produce quite a few interesting results.If you want the most recent version of Metasploitable, version 3 can be foundon GitHub. You can download version 2 (which I'm using)from SourceForge. For a Raspberry Pi-based version of a vulnerable machine, check out our guide linked below.More Information:How to Set Up a Practice Computer to Kill on a Raspberry Pi 3Now that that's out of the way, select the "Scans" tab on the dashboard, a drop-down menu will appear — select "Tasks." For this guide, we'll use the wizard to set up our scan, so click on the wand icon in the top left to select the "Task Wizard."I will be scanning a single host on my network. However, GSA acceptsCIDRnotation, making it incredibly easy to scan an entire subnet. Once you are satisfied with your target, click "Start Scan."Don't Miss:How to Scan for Vulnerabilities with NessusWe can see the status of the scan under theStatuscolumn. At this point, I've had the scan going for around 20 minutes.When the scan is complete, my vulnerable machine receives a 10 out of 10 for severity.Let's have a look at some of the issues Greenbone Security Assistant has found. In theReportscolumn, under theLastsub-column, click on the date. This will bring up the report's results page.We got a lot of hits! Of course, not all of these will lead to ingress, but it gives an excellent starting point to assess high-level problems. Clicking on a vulnerability will give a summary of the issue detected.The Task Wizard isn't the only way to use the Greenbone Security Assistant. You can create custom scans, custom scan rules, and schedule scans to run while the machine is not in use. I like the wizard because it gives me a quick overview of potential vulnerabilities.Step 2: Scan for Vulnerabilities with Custom TasksSometimes, the Task Wizard isn't what you're looking for. It's important to know how to create your own scanning task. To get started, hover over the "Scans" tab at the top of the page. Select the "Tasks Options." Hover over the star icon in the top left corner, then click the "New Task" option. You will be presented with a dialog that allows you to configure your new task.Let's talk about some of the less obvious options here.Scan Targetsis a drop-down menu. At the moment, our scan target is the entire subnet. To add a target, you can click on the star icon to the right of the drop-down menu.TheAlertsoption allows us to configure alerts. Click the star beside it for options like task status changes, severity levels, and matching results. Greenbone Security Assistant will email you if any of the criteria are met. "Overrides" allow you to override the reporting behavior of GSA, which can be helpful to sort results and reduce false positives.TheMin QoDis the quality of detection, which indicates how sure the scanner is that this vulnerability exists. As it is set at 70 percent, there will be some false positives. At 100 percent, the reports will only contain vulnerabilities that were exploited. This can help filter results.Using OpenVAS & GSA in the Real WorldOpenVAS with Greenbone Security Assistant is a great, open-source way to locate potential issues on a network. In the hacking world, using a loud active scanner like OpenVAS would almost certainly expose your presence to network admins. In a security audit, however, it's an excellent starting point to gain a "helicopter view" of potential targets. The reports are not 100 percent accurate, and they may miss things, but vulnerability scanners like OpenVAS are essential to providing high-level insight while assessing network issues.Follow Null Byte onTwitterandGoogle+Follow WonderHowTo onFacebook,Twitter,Pinterest, andGoogle+Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo byhxdbzxy/123RF; Screenshots by Barrow/Null ByteRelatedHow To:Install OpenVAS for Broad Vulnerability AssessmentHow To:Get OpenVas Working Properly in KaliHow To:Use NMAP 7 to Discover Vulnerabilities, Launch DoS Attacks and More!How To:Hack a network with Nessus 3How To:Scan Your Samsung Galaxy S3 for Malware, Infected Apps, & Unauthorized SurveillanceAndroid for Hackers:How to Scan Websites for Vulnerabilities Using an Android Phone Without RootHow To:A Hitchhiker's Guide to the Internet: Today and Now, How It All ConnectsHow To:Hack a NETBIOS IPC$ shareNews:What REALLY Happened with the Juniper Networks Hack?How to Hack Wi-Fi:Disabling Security Cameras on Any Wireless Network with Aireplay-NgHow To:Audit Web Applications & Servers with TishnaHow To:Identify Antivirus Software Installed on a Target's Windows 10 PCHow To:Port scan with NmapHow to Hack Like a Pro:Getting Started with MetasploitNews:Life Becomes More Difficult for Driverless HackersHow To:Use SELinux Targeted Policy to Secure Your HostsVideo:How to Crack Weak Wi-Fi Passwords in Seconds with Airgeddon on Parrot OSHow To:How a Home Energy Audit Can Lower Your Energy CostsIPsec Tools of the Trade:Don't Bring a Knife to a GunfightNews:Obama and Congress Approve Resolution that Supports UN Internet TakeoverNews:Bugzilla Cross Site Request ForgeryNews:Backtrack 5 Security EssentialsNews:Secure Your Wireless Network from Pillage and Plunder in 8 Easy StepsNews:Want a Career in IT Security? Our IT Recruiter Shares the Top Qualifications in Demand Right NowTor vs. I2P:The Great Onion DebateRevealed:Hundreds of words to avoid using onlineNews:Ron Paul’S Audit the Fed Bill Overwhelmingly Passes in the HouseGHOST PHISHER:Security Auditing ToolHow To:Secure Your Computer with Norton DNSDon't Get Doxed:5 Steps to Protecting Your Private Information on the WebFor Sale:JFK's Crusty, 48-Year-Old Birthday CakeNews:Accounting and Finance DegreeNews:Senate Dems back increase in air travel fee to close funding shortfall at TSANews:40 Fed Agencies Man Command Center Outside ChicagoNews:Massive Leak! Wikileaks publishes Stratfor emails.Beyond the Still:Chapter 2 Winner