# OpenVAS

The OpenVAS Greenbone Security Assistant application has various tabs that you can interact with. For this section, we will be digging into the scans. If you navigate to the `Scans` tab shown below, you will see the scans that have run in the past. You will also be able to see how to create a new task to run a scan. The tasks work off of the scanning configurations that the user sets up.

<figure><img src="https://537410186-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH9oYbVb7VAsDxBfUpLeo%2Fuploads%2FsZ1cM0HcLAX5cWYxcyuf%2Fimage.png?alt=media&#x26;token=f8988826-5952-4b5e-be3b-b72ce0e75eb7" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
For this module, the Windows target will be `172.16.16.100` and the Linux target will be `172.16.16.160`.
{% endhint %}

<figure><img src="https://537410186-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH9oYbVb7VAsDxBfUpLeo%2Fuploads%2FqwgzENt2YXgim4BnKqAz%2Fimage.png?alt=media&#x26;token=fa5d43a9-282a-4b89-b841-98803ec7af1c" alt=""><figcaption></figcaption></figure>

## Configuration

Before setting up any scans, it is best to configure the targets for the scan. If you navigate to the `Configurations` tab and select `Targets`, you will see targets that have been already added to the application.

<figure><img src="https://537410186-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH9oYbVb7VAsDxBfUpLeo%2Fuploads%2FAYmNuwh1PT7lMNTMwfT6%2Fimage.png?alt=media&#x26;token=3cefa75c-6ccd-41cb-9271-b2ab978d3382" alt=""><figcaption></figcaption></figure>

To add your own, click the icon highlighted below and add an individual target or a host list. You also can configure other options such as the ports, authentication, and methods of identifying if the host is reachable. For the `Alive Test`, the `Scan Config Default` option from OpenVAS leverages the `NVT Ping Host` in the `NVT Family`. You can learn about the NVT Family [here](https://docs.greenbone.net/GSM-Manual/gos-6/en/scanning.html#vulnerabilitymanagement-create-target).

<br>

<figure><img src="https://537410186-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH9oYbVb7VAsDxBfUpLeo%2Fuploads%2F4OYftHCc4OarzxJYFh4B%2Fimage.png?alt=media&#x26;token=0f21b98b-a221-459a-823a-697c96d56610" alt=""><figcaption></figcaption></figure>

Typically, an `authenticated scan` leverages a high privileged user such as `root` or `Administrator`. Depending on the permission level for the user, if it's the highest permission level, you'll retrieve the maximum amount of information back from the host in regards to the vulnerabilities present since you would have full access.

Once you have added your target, they will appear in the list below:

<figure><img src="https://537410186-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH9oYbVb7VAsDxBfUpLeo%2Fuploads%2FUlkJKv84n5fHg7bh07S8%2Fimage.png?alt=media&#x26;token=dec5eae4-8d08-456e-b27c-c1c587ebdf2c" alt=""><figcaption></figcaption></figure>

## Setting Up a Scan

Multiple scan configurations leverage OpenVAS Network Vulnerability Test (NVT) Families, which consist of many different categories of vulnerabilities, such as ones for Windows, Linux, Web Applications, etc. You can see a few different types of families shown below:

<figure><img src="https://537410186-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH9oYbVb7VAsDxBfUpLeo%2Fuploads%2F9hjbUHDGeJote19y4fCJ%2Fimage.png?alt=media&#x26;token=3fa32251-073f-4730-9981-855d841a5386" alt=""><figcaption></figcaption></figure>

OpenVAS has various scan configurations to choose from for scanning a network. We recommend only leveraging the ones below, as other options could cause system disruptions on a network:

* `Base`: This scan configuration is meant to enumerate information about the host's status and operating system information. This scan configuration does not check for vulnerabilities.<br>
* `Discovery`: This scan configuration is meant to enumerate information about the system. The configuration identifies the host's services, hardware, accessible ports, and software being used on the system. This scan configuration also does not check for vulnerabilities.<br>
* `Host Discovery`: This scan configuration solely tests whether the host is alive and determines what devices are `active` on the network. This scan configuration does not check for vulnerabilities as well. *OpenVAS leverages ping to identify if the host is alive.*<br>
* `System Discovery`: This scan enumerates the target host further than the 'Discovery Scan' and attempts to identify the operating system and hardware associated with the host.<br>
* `Full and fast`: This configuration is recommended by OpenVAS as the safest option and leverages intelligence to use the best NVT checks for the host(s) based on the accessible ports.<br>

You can create your own scan by navigating to the 'Scans' tab and clicking the wizard icon.

<figure><img src="https://537410186-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH9oYbVb7VAsDxBfUpLeo%2Fuploads%2F8CKYCzdUu5BHkEj2o0H2%2Fimage.png?alt=media&#x26;token=a8eb5139-1dff-4799-b49a-2761aad7fb4b" alt=""><figcaption></figcaption></figure>

Once you click the wizard icon, the panel shown below will pop up and allow you to configure your scan.

<figure><img src="https://537410186-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH9oYbVb7VAsDxBfUpLeo%2Fuploads%2Fvmo1PXgZR193PovVdH0t%2Fimage.png?alt=media&#x26;token=014b59c6-666c-44e8-895d-e699501a90fd" alt=""><figcaption></figcaption></figure>

We will configure the scan with the options below, which targets `172.16.16.160` and then run our scan, which can take `30-60 minutes` to finish.

<figure><img src="https://537410186-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH9oYbVb7VAsDxBfUpLeo%2Fuploads%2FIglYETdSGCaVaUCuUdtx%2Fimage.png?alt=media&#x26;token=58818b51-91dd-4b7c-8015-95ae8a171bfa" alt=""><figcaption></figcaption></figure>

<figure><img src="https://537410186-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH9oYbVb7VAsDxBfUpLeo%2Fuploads%2FlP9Ui8x9CCmbzgz8eVSU%2Fimage.png?alt=media&#x26;token=2bd92007-7acc-4b36-b978-18b5f38f666d" alt=""><figcaption></figcaption></figure>
