Import nmap scan results into OpenVAS

Question

I have recently been introduced to OpenVAS for scanning our network at work. I am familiar with nmap, and I am happy with it's performance when used stand-alone from the cli, through iptraf I can see it is scanning at speeds upwards of a thousand packets a second, however when scanning through OpenVAS I can't seem to break 30 packets a second, even with the nmap preferences set to scan 25 concurrent hosts with a --min-rate of 25 packets per second.

I would really like to first scan using nmap then import the results into OpenVAS for further vulnerability testing, Ideally having OpenVAS only probe the open ports that nmap reported.

I have been googling and googling and I have not found any clear instructions on how to import the results. IMO I would think this would be a pretty standard feature.

Any ideas on how I can import grepable or xml nmap results into OpenVAS for further penetration testing?

Answer 1

OpenVas now has the ability to import Nmap scan results in .xml format, which to me, is great. I like performing nmap scans outside of a vulnerability scanner because not only can I have greater control over some parameters such as "--top-ports" etc, but I re-use the results often (e.g. metasploit import) and prefer having them as "standalone files" for that reason.

To import them using Greenbone Assistant: select your scan configuration >> edit port scanners >> edit Nmap >> import results file >> save.

Answer 2

Vulnerability scanners are designed to port scan hosts and then decide what further checks to do based on the results of the port scan. They are not designed to use port scan information from another source, so the feature you are looking for is not there. I can't see a scenario where that would really work well for you. Plus, it's extra work - you want to be able to point a vulnerability scanner at a set of hosts and forget about it.

It sounds more as if you have a performance problem with OpenVAS. I'd tackle that with the developers to get a resolution before trying to import external information into the system, after all if a port scan is running so poorly why would the rest of it perform better?