Vulnerability Scanning With OpenVAS // SJ

WHAT IS VULNERABILITY SCANNING?

Vulnerability scanning is the inspection of digital systems to find weaknesses — and it's an important compliance requirement of many regulatory bodies.

// ANALOGY

Think of it like walking through your home and checking for ways an intruder could get in:

A window without bars or locks = an open port with no protections.
A cracked wall = outdated software with known bugs.
A flimsy door = weak passwords.

Patching is like adding locks, repairing cracks, or installing gates to make the house safer.

Another way to think about it: it's like running a diagnostic scan on your car — low tire pressure, bad brakes, a check engine light. You fix the problems before the car breaks down or becomes unsafe.

TYPES OF VULNERABILITY SCANS

AUTHENTICATED SCAN

Requires the subject host's credentials. More detailed — identifies vulnerabilities that can be exploited by attackers who already have access to the host. Provides deeper visibility into configuration and installed applications. Example: scanning an internal database by providing its credentials to the vulnerability scanner.

UNAUTHENTICATED SCAN

Does not require credentials — all that's needed is an IP address or network range. Identifies vulnerabilities exploitable by an external attacker with no access to the host. Fewer resources, more straightforward setup. Example: scanning a public-facing website for vulnerabilities any user could exploit.

INTERNAL SCAN

Conducted from inside the network. Focuses on vulnerabilities that would be exposed to attackers once they're already inside — what can be exploited after a breach.

EXTERNAL SCAN

Conducted from outside the network. Focuses on vulnerabilities exposed to attackers from the outside — what's visible before a breach even happens.

CVE & CVSS: READING THE RESULTS

When you run a vulnerability scan with a tool like OpenVAS, you don't just get a list of problems — each finding is usually tied to a CVE ID (Common Vulnerabilities and Exposures). Think of it as the vulnerability's "license plate number" in a global database of known flaws.

// CVE FORMAT

CVE- → prefix marking it as a registered vulnerability
Year → when the vulnerability was published or discovered
Digits → a unique identifier, often four or more numbers

Example: CVE-2023-12345 — a flaw published in 2023, entry number 12345.
The CVE system is maintained by MITRE Corporation, which also develops the ATT&CK framework.

Alongside CVE IDs, each finding is scored with CVSS (Common Vulnerability Scoring System) — a 0–10 scale that tells you how severe a vulnerability is. Together, CVE and CVSS help you prioritize: which ones need patching right away, and which can wait.

0.0 – 3.9

LOW SEVERITY

4.0 – 6.9

MEDIUM SEVERITY

7.0 – 8.9

HIGH SEVERITY

9.0 – 10.0

CRITICAL SEVERITY

HOW I SET UP OPENVAS

I set up OpenVAS in an Ubuntu lab environment. Since OpenVAS runs inside a container, my first step was installing Docker — a platform that bundles applications with everything they need to run in lightweight, portable containers.

Once Docker was ready, I pulled down the Immauss OpenVAS container, which made setup much faster than building from scratch. Running the container mapped OpenVAS to port 443, so I could open the web interface at https://127.0.0.1. After logging in with the default credentials, I was greeted by the Greenbone Security Assistant (GSA) dashboard — and ready to launch my first scan.

$ docker run -d -p 443:443 --name openvas immauss/openvas // pulling container... mapping port 443... initializing GSA dashboard

OpenVAS walks you through a handful of setup steps — defining a target, configuring a task, and choosing a scan type. Once those were in place, I hit Start Scan.

OVERVIEW // Vulnerability scanning — inspecting systems to find weaknesses before attackers do.

OpenVAS Task Configuration — My First Task

SCAN CONFIG // Named "My First Task" — Full and fast scan config, OpenVAS Default scanner, QoD threshold 70%.

THE SCAN: RUNNING IT

I named it My First Task and chose the "Full and fast" scan config. The scan ran sequentially across hosts with overrides applied. The status bar crept up from 2%... and I waited.

STEP 1 // Installing Docker — the platform that runs the OpenVAS container.

STEP 2 // Pulling and running the Immauss OpenVAS container, mapped to port 443.

STEP 3 // Starting the container.

STEP 4 // Accessing the Greenbone Security Assistant dashboard at https://127.0.0.1.

Scan Completion — 8 minutes 27 seconds, 26 findings

SCAN COMPLETE // Duration: 8 minutes 27 seconds. Total results: 26 findings. 1 report generated.

THE RESULTS

The scan finished with 26 findings. The majority were low-severity or informational logs, with 1 medium vulnerability. The dashboard showed a pie chart of severity classes, a bar chart of vulnerabilities by CVSS score, and a word cloud — SSL/TLS came up a lot in mine.

Results Dashboard — severity distribution

RESULTS DASHBOARD // 24 low-risk findings, 1 medium, 1 critical. Severity visualized across pie chart and CVSS bar chart.

THE BIG ONE: CVSS 10.0

This was the biggest eye-opener. OpenVAS flagged a critical vulnerability scoring CVSS 10.0 — the system was running on default credentials (admin:admin).

🚨 CRITICAL FINDING // CVSS 10.0

Vulnerability: Default Credentials (admin:admin)

Port: 9390/tcp

Attack Vector: Remote (OMP/GMP) — no authentication required

Impact: Complete system compromise possible

Remediation: Change the default password immediately. Implement MFA. Restrict network access to management interfaces.

Critical vulnerability detail — CVSS 10.0 default credentials

CRITICAL FINDING // CVSS 10.0 — default credentials flagged on port 9390/tcp. Complete access possible without authentication.

// KEY TAKEAWAY

Seeing a CVSS 10 flagged on my very first scan really brought home why default credentials are such a massive risk — and why even "basic" hygiene steps can make or break security. It's a textbook example of why hardening even a fresh install matters.

WRAP UP

Running this first vulnerability scan with OpenVAS was such a proud moment. Up until now, most of my cybersecurity learning has been theory — reading about CVEs, CVSS, scanning tools. Finally getting hands-on, setting up the environment, running the scan, and seeing real vulnerabilities pop up — including a critical CVSS 10 — made everything feel real. I can't wait to keep practicing, dive deeper into authenticated scans, and learn how to remediate the issues I find. This is just the beginning. But every lab like this makes me feel one step closer to becoming the security analyst I want to be.

Theory is great, but this lab reminded me: nothing beats hands-on practice.