10

I am practising in my lab with some metasploitable machines, and I just realised that the vulns declared by OpenVAS 6.01 in the scan report aren’t imported in Metasploit 4.11.5 by the db_import report-blah.xml.

When I read the report on the OpenVAS web interface, I see 72 vulns (with all kinds of vulnerabilities like ms15-043, a backdoor on port tcp 1524, etc.) but on the Metasploit db, I just have 51.

I also tried to import the report in nbe, but there is no difference. diff msf hosts vs openvas report

  • How many vulns were in the database before you imported? Is the problem that the numbers are different or is it that the vulns aren't being imported at all? – schroeder Dec 3 '15 at 0:00
  • sorry about my first explanation .., there was none vulns on the database , just run a nmap scan ,no script something like (db_nmap -sS -Pn -A -iL someFile.txt), then run some auxiliary modules for version recognition over the open ports , and finally the openvas with this . the problem is they are not imported , and more important if this is happening with this , it could be happening with all the data imported by the db_import (in metasploit ). – Sarastro Dec 3 '15 at 0:48
  • When you run db_import, what does the console say? – schroeder Dec 3 '15 at 0:56
  • when i import a OpenVAS xml says "importing OpenVAS XML , successfully imported and the name of the file ", when i import a nmap xml says the same plus the nokogiri gem v 1.6.6.2 – Sarastro Dec 3 '15 at 1:03
  • It's odd that it reports a successful import and the data isn't there. At this point, I would ask on the Rapid7 community site for Metasploit. – schroeder Dec 3 '15 at 4:29
1

Have you tried to load the openvas plugin in MSF, connect to your running openvas server, and import your report directly from openvas by issuing "openvas_report_import report_id nbe"?

I was having the same problem as you until I imported using the plugin.

0

Yes, there have been known errors in importing XML from OpenVAS into MSF and technically there isn't a fix as of now. I would suggest you use faraday which simplifies integrated penetration testing and just not only combines metasploit and openvas but also combines results from many other tools like Nmap, Nessus, Nikto and much more.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.