Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I have configured the OpenVAS server as per wiki instructions:

http://www.backtrack-linux.org/wiki/index.php/OpenVas

And i ran the following commands:

msfconsole
load openvas
openvas_connect admin toor 127.0.0.1 9390
openvas_target_create Metasploitable 192.168.56.101 "Target Machine"
openvas_task_create Scan1 Scan1 3 1
openvas_task_start

When i download the report, it doens't show any vulns. Can someone tell me what i did wrong?

Both BT5 and Metasploitable are run in VirtualBox with host only adapters, and BT5 can ping the ip address of the metasploitable target machine.

share|improve this question
What happens when you run OpenVAS by itself on the target? Does it return results? – schroeder May 28 '12 at 21:26
I assume you specified the task to start in your "openvas_task_start" ... Does openvas_report_list show a report, or is the report empty? – schroeder May 28 '12 at 21:35
I did indeed specify openvas_task_start. openvas_report_list did indeed show a report, but the report is blank when i did downloaded and viewed it. I have not tried OpenVAS by itself, i will do so when i have access to backtrack again. – Terry Chia May 29 '12 at 6:52

1 Answer

up vote 0 down vote accepted

Its difficult to tell what limiting network factors might be involved without a full network map, but if you have both operating systems running within Virtualbox on the same host, I would guess that its a virtualbox issue. You've got one os trying to scan the other os's network stack, while both networks are using the same network card. Switching to bridged and using a different connector for each would likely return more accurate results.

To test if the backtrack vm can even communicate with the metasploitable one, I would suggest trying to set up a telnet or ssh connection between the two, or to open up a netcat listener on the metasploitable box and scan it with nmap. Usually a vulnerability scanner reporting nothing at all is indicative of networking issues.

share|improve this answer
I can telnet the other machine from backtrack. Using nmap for port scanning returns the expected results. Running nikto against metasploitable returns vulnerabilities i can use. Exploiting said vulnerability with metasploit works as well. All factors point to an openVAS misconfiguration, but i have followed the instructions in the backtrack wiki exactly. This is very puzzling. – Terry Chia May 28 '12 at 0:38
Have you updated the openVAS nvts? If you haven't openVAS will have no vulnerabilities to test out. backtrack-linux.org/wiki/index.php/OpenVas – sublimepua May 28 '12 at 0:42
Yes, i ran openvas-nvt-sync everytime i turned on backtrack. – Terry Chia May 28 '12 at 0:43
Wait... does both backtrack and the metasploitable vm have the same ip address at 192.168.56.101? If so, you're basically scanning yourself from within yourself. – sublimepua May 28 '12 at 1:18
Backtrack has the IP 192.168.56.102, metasploitable has the IP 192.168.56.101 Very puzzling situation. I think i might try another vulnerability scanner like nessus or nexpose instead. – Terry Chia May 28 '12 at 1:33
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.