Questions tagged [openvas]

OpenVAS is a collection of open source tools for vulnerability scanning and management.

Filter by
Sorted by
Tagged with
1
vote
1answer
68 views

Missing HTTPOnly Cookie Attribute in Laravel 7 [duplicate]

I have a Laravel site, I thought I patched this issue already. I got these in my session.php 'secure' => true, 'http_only' => true, But OpenVas still detected that I still need to it. It ...
1
vote
1answer
154 views

PHP is prone to an information-disclosure vulnerability

I am looking for help to understand the issue below. OpenVAS finds a vulnerability where it points to PHP versions 5.4.3 and 5.3.13. But the two hosts I checked with OpenVAS, both are with PHP 7.2.x. ...
3
votes
1answer
245 views

Why OpenVAS does not find all open ports compared to Nmap?

I recently launched a system discovery scan with OpenVAS to an IP from my net to compare its results to Nmap. As you can see in the image OpenVAS does not find all the ports Nmap does. Both scans ...
1
vote
1answer
250 views

OpenVAS - how does it know if an SQL vulnerability is open?

I'm trying to intentionally open up an SQL vulnerability in a web app to see if OpenVAS will pick it up. There's a url that OpenVAS tries, which is /news/?group_id=&limit=50&offset=50;select+...
0
votes
1answer
85 views

metasploit openvas plugin not connecting to OpenVAS9-Manager

I recently installed openvas9 following this guide. I can log into the web interface on port 4000 just fine, and I ran a scan on my metasploitable VM for testing, and it seems good. Now I wanted to ...
5
votes
1answer
176 views

What could an attacker do on a server where Source Control Management (SCM) files are accessible?

I'm testing some servers with OpenVAS and I run into some SCM files that are remotely accessible: .git/config .git//info/exclude .git/description .git/HEAD that contains refs/heads/master and .git/...
2
votes
1answer
1k views

openVAS: uninitialized constant OpenVASOMP::OMPConnectionError [closed]

I was searching in many forums regarding this issue like here and here, but they were mentioning using port 9390. I launched OpenVAS on port 9390, but I still get the same error. I am using openVAS ...
0
votes
0answers
167 views

Can OpenVAS do a scan on a scanner device?

I know OpenVAS can scan printers with just tweaking some scan configuration. I try to scan a scanner device but I only get one result which is OS Detection Consolidation and Reporting. I have an ...
1
vote
1answer
198 views

Understanding OPENVAS Wireshark Capture

I was looking at a sample capture from a tutorial I was looking at and below is a snippet of a wireshark packet capture: OpenVAS:() { _; OpenVAS; } >_[$($())] { echo Content-Type: text/plain; ...
1
vote
1answer
7k views

Scan a web application in OpenVAS

As the title says. How can I do it in OpenVAS? The other group has a website for example: https://thiswebsite.com/main.php and in that website there is a web application for example: https://...
4
votes
2answers
4k views

OpenVAS won't generate SCAP Database

To deploy OpenVAS to Virtual machines I've been using Ansible for a while and it worked pretty well. Now today I wanted to deploy it to another machine but the openvas-check-setup script keeps telling ...
5
votes
1answer
256 views

Is it possible to invoke OS commands from a NASL script in OpenVAS?

I was wondering if it is possible to run a command like cat, w3m or any other Operating System (Linux) utility from inside a NASL script and use its output. Do you know any examples? I know you can ...
2
votes
1answer
3k views

OpenVas gets stuck on some scans

We have been using OpenVas to scan our servers for months now. Recently the scans are getting stuck on different %, always below 30%. We did not change anything in my local configuration. I read a ...
1
vote
1answer
2k views

Change settings to scan a printer with openvas

I have Openvas 5.1.1 (gui: Greenbone Security Assistant Version 7.0.2). It misidentifies my linux server as a printer. Scan result includes Solution If you want to scan the remote host, uncheck ...
2
votes
1answer
230 views

RRD Performance reporting with GSA/OpenVAS

I'm running Greenbone Security Assistant 7.0.2 (on Kali Linux) and the default performance reporting currently goes a "Fallback Report" which only dumps /proc/meminfo to the screen. A note on the page ...
2
votes
1answer
1k views

Openvas : Change in port list has unexpected results

I have encountered strange results while changing only the port list for some targets. If I use the wizard (immediate scan) to scan a couple of hosts, I get a report with some medium vulnerabilities. ...
1
vote
1answer
662 views

OpenVas remediation cipher suites

This is my first time running a vulnerability scan software like OpenVas. It is really a great tool to found out about vulnerabilities in the network. I have found difficult to troubleshoot the ...
6
votes
2answers
3k views

False positives in OpenVAS

I recently ran the 1st vulnerability scan in my offices network using OpenVAS. We received a great deal of false positives. Mostly I saw that (at least some) tests are unaware of internal patches in a ...
0
votes
1answer
872 views

Vulnerabilities Database by OpenVAS

Does OpenVAS make use of a Vulnerability Database to detect vulnerabilities? Which one does it use if it does?
2
votes
1answer
796 views

What OpenVAS tasks (scans) should I be running?

I have recently set up OpenVAS on my local office network. I have run a few tasks but I was curious on what tasks I should really be running and within what timeframes? clarification I'm currently ...
2
votes
1answer
74 views

system security needs classification

I am working on a way to classify our systems (everything that is reacheable through ip) on how bad it would be and how possible it is, that someone would get unauthorized access using exploits. I ...
2
votes
1answer
1k views

Running a single NVT via OpenVAS?

OpenVAS has many NVTs, and running regular scans is very noisy. Is it possible to run a single NVT on a target (e.g., IP address and port)? If possible, how can I do it?
1
vote
1answer
3k views

Looking for STIG/SCAP Scanner [closed]

Problem: I wish to build a VM that I can take onsite to clients to perform "SCAP" like scanning of their domain controllers. I don't need vulnerability scans in terms of like missing patches or ...
2
votes
2answers
680 views

Do the Greenbone scan reports actually differ from a typical OpenVAS scan report?

My company is planning to use a Greenbone appliance in the near future and wants to analyze the results with another tool. I have access to OpenVAS with GSA so I am able to test the analysis now with ...
0
votes
1answer
407 views

OpenVAS: This CPE does not appear in the CPE dictionary but is referenced by one or more CVE

Any ideas on what may be causing this message to appear when following the link from "Detected Applications"? This CPE does not appear in the CPE dictionary but is referenced by one or more CVE. ...
4
votes
1answer
742 views

Best practices manual for Alienvault USM?

Is there any best practices manual for Alienvault USM? I found some information about the profiles for the vulnerability scanner but nothing about how often I should launch the scan or which ...
1
vote
1answer
1k views

metasploit+openvas error

switched to openvas a couple days, is open and does the job.. so far so good, but I hit a wall.. with metasploit I load the module, I log in, fine.. but when I run some tasks I get some errors.. I ...
4
votes
1answer
3k views

Metasploit & openvas error (openvas_connect)

I'm using Kali 4.3.0 and trying to run openVAS plugin into the Metasploit. OpenVAS (version 8.0) works properly on port 9392, metasploit is ok too. This is log of error: msf > openvas_connect ...
4
votes
1answer
504 views

Is this a reasonable approach of continous network monitoring?

I'm currently implementing some mechanisms to continuously monitor our network. Most of this is done through OSSIM but I also extended it by some self written monitoring scripts. Im currently doing ...