Hot answers tagged

6

For my answer I presume that this is the git repository of the application that the server is running, that it contains the full git repository, and that you are able to download the whole thing. This is both surprisingly common and surprisingly dangerous. The git repo contains not just all the code actively deployed on the server, but also every line of ...


5

The approaches you mention are a bit confusing, and I will explain why. In a properly designed infrastructure many of the bulletpoints you listed would be addressed: Hourly host discovery scans - If you implement strong port security on your switches, and used NAC - PacketFence (since you mentioned open source, I did also) you wouldn't need to worry about ...


4

There is the NASL function pread which allows you to run external commands from within a NASL script. An example to run cat and get its output could be: args = make_list( "cat", # The cmd which is called, needs to be in cmd as well "/etc/passwd" ); ret = pread( cmd:"cat", # The command to run argv:args, # The arguments list ...


4

The NVT is doing a check for both CVEs remotely are not showing a vulnerability against a Linux system by default. If they are showing up I can think of two possibilities: You have configured your filters to show results of NVTs with a low "Quality of Detection (QoD)". See [1] for a description of the QoD and [2] for the "default" value of 70 in your filter ...


3

From the documentation: httponly If set to TRUE then PHP will attempt to send the httponly flag when setting the session cookie. From your code: 'http_only' => true, Thus, it looks like you spelled it wrong, i.e. you spelled http_only whereas it should be httponly.


3

Don't Connect to 9392. Instead Connect to 9390 openvas_connect username password localhost 9390 ok


3

You can view the Network Vulnerability Tests (NVTs) here or here, the majority of these will be downloaded as .nasl files (Nessus Attack Scripting Language). To see exactly what they test against or to edit them the simplest way to install OpenVAS and update it, then look at the code for each of the .nasl files in the filesystem. By default these can be ...


2

There's a couple of different approaches you can take with Vulnerability scanners like OpenVAS and they'll produce somewhat different results. Uncredentialed scanning, you just provide the IP addresses and the scanner assesses what it can from the network perspective. What it's doing under the covers is completing a port scan and then assessing against a ...


2

Being able to detect exact installed software versions on a given system, authenticated vulnerability scans are per definition better than unauthenticated scans. Also, with the help of authenticated scans it is possible to detect configuration weaknesses which otherwise would have gone unnoticed. I only recommend running unauthenticated scans if you want ...


2

It seems to be the case that an apt-get dist-upgrade caused the trouble. After setting up another VM leaving this step out the installation finished sucessfully. // Eventhough I got it running I'm now using Ubuntu Server and the packets provided by Mohammad Razavi when it comes to virtualized instances of OpenVAS. I had severe problems handling the scans. ...


2

ok so I went ahead and did try and that seem to have worked now no error. msf > openvas_report_import 2 14 [*] Importing report to database. msf > so vim /usr/share/metasploit/lib/openvas/openvas-omp.rb and change the line where timeout to Timeout.timeout openvas]$ ruby -c openvas-omp.rb Syntax OK


2

OpenVAS is not an application scanner. It is a vulnerability scanner. It is worth reading Greenbone's documentation on it here. If your web application has a vulnerability that OpenVAS has in its database, and you scan the IP address and port that the web app is on, then yes, it should be found. Greenbone also gives you the progress of scans by IP (but ...


2

After studying and analyzing data from packet captures of both scans I discovered the answer. Apparently, OpenVAS works this way: 1) TCP 3way handshake on port 2) OpenVAS asks different famous protocol questions (HTTP, telnet, etc.) to get an answer with data (banners). 3) If it does get answers, it will create a report with all that data and say its ...


2

OpenVAS (now part of GVM) is a Vulnerability Scanner. Scanners of this class are checking applications / systems for "known" vulnerabilities like SQL injections within a CMS / Blog software or similar where e.g. a vendor advisory or a security researcher report exists. The check is then done in one of the following ways: based on an exposed version by an ...


2

In the file /etc/init.d/openvas-manager, which manages the service, you will see that it includes a file with parameters and then uses the variables from that file as arguments. # Read configuration variable file if it is present [ -r /etc/default/$DESC ] && . /etc/default/$DESC # Update DAEMON_ARGS with optional settings from /etc/default [ -n "...


2

Can / will be answered with 3. together below. To the best of my knowledge it is a mixture of both. The internal scheduler of OpenVAS is scheduling and launching VTs based on a dependency chain (e.g. VT y.nasl depends on VT x.nasl) so the VT get consecutively launched depending on this dependency chain. But then again the order depends on at which time the ...


1

By default, OpenVAS will ping before it scans and it will ignore any system that doesn't respond to ping. This is to speed up the scan and avoid doing a full scan on a dead port. Edit your scan target and change the Alive Test to Consider Alive. This tells OpenVAS that you always want to scan this target, even if it doesn't respond to ping. This is the page ...


1

This VT is doing an "active" HTTP POST request to the mentioned URL http://domain:port/ with the following data: HTTP Method: POST POST body: <?php phpinfo();?> to the following two URLs (one after another): URL1: http://domain:port/?-dallow_url_include%3don+-dauto_prepend_file%3dphp://input URL2: http://domain:port/?%2D%64+%61%6C%6C%6F%77%5F%75%72%...


1

OpenVAS is not being used; that name is arbitrary, and perhaps a red herring, or a nose-tweak of people analyzing it (such as yourself). This is an example of the shellshock bug which was very big news four years ago. Use the search box to find dozens of Qs about it here on security.SX and nearly as many on unix.SX and serverfault. This example is clearly ...


1

Check out the greenbone-scapdata-sync --help for some other options that may work; specifically these: greenbone-scapdata-sync --refresh greenbone-scapdata-sync --refresh-private As far as I can tell, they are specifically designed to rebuild scap.db when the other files in /var/lib/openvas/scap-data are present. Worked for me, anyway.


1

Thanks for the recommendations. I ended up reinstalling everything from scratch. Also applied Uberhumus suggestion of setting scan order to random. Other settings I applied: Maximum concurrently executed NVTs per host = 4. Maximum concurrently scanned hosts = 5. I created targets with about 50 hosts per scan. Disabled the "automatic suspend" in power ...


1

The problem seems to me that you're trying to edit a pre-made and static configuration. You're correct that you're not supposed to change it in the .conf file. What I'd recommend doing is: 1 Cloning the scan you want (In this case "Full and Very Deep Ultimate") by clicking the sheep icon next to it in the "Scan Configs" page. 2 Going back to the "Scan ...


1

Quoting the relevant part of the source code documentation: Prerequisites for generating system reports: A program in the PATH, with usage "openvasmr seconds type", where seconds is the number of seconds before now that the report covers, and type is the type of report. When called with type "titles" the script must print a list of ...


1

Depending on the target system the port scan of ALL UDP and ALL TCP will take too long to finish, the portscanner will timeout and thus information about the portscan got lost. Try again with a different portlist with less UDP ports. This can be configured in the GSA when creating a new Target via Configuration -> Targets. A good start could be either "All ...


1

Can a server have cipher suites enable/disable in some ports? Can my Windows Server have SSL3 enable in port 48004, but disable on port 443? Yes. The actual application bound to a specific port may be different or may have a different configuration. For example, you could run apache on 443 and nginx on port 8000. You may be running some other app or DB ...


1

This sounds like you might be looking for some of what is covered in the CERT-RMM. http://www.cert.org/resilience/products-services/cert-rmm/index.cfm I suspect the scope of the Resilience Management Model may exceed your current project but the objective you describe appears to be part way down the path of what RMM codifies. One other tangental benefit ...


1

Yes it's possible, but it's not particularly pretty and I'd recommend against this route if you need to do this for more than a handful of NVTs. In the GUI this can be achieved by creating a new Scan config. Click on Scan Configs (under Configuration), and then click on the star icon in the top left to create a new one. Name the configuration as desired, ...


1

You could use JovalCM.com but I honestly don't see why OpenSCAP or ovaldi would also not work. OpenVAS supports integration of ovaldi in its checks if you set it up in the advanced configuration. SCAP requires credentials and the output from OpenVAS is also suspect (e.g., lots of false positives, false negatives, and other errors) when performed without ...


1

I just got an answer to this question from a salesperson working at Greenbone. The OpenVAS-reports and the Greenbone-reports have indeed the same structure. So if you are using a parser which works on OpenVAS-reports, it will also work on the reports generated by the Greenbone appliance. The only differences are - as the salesperson put it - in quality. But ...


1

I encountered this same issue using OpenVAS on Kali Linux from behind a firewall that doesn't allow the rsync protocol outbound. Most of the OpenVAS updates use HTTPS, but one of its databases can only be updated via the rsync protocol. Look at any firewall logs from between your OpenVAS system and the internet to confirm there are rsync connections being ...


Only top voted, non community-wiki answers of a minimum length are eligible