-
Notifications
You must be signed in to change notification settings - Fork 0
/
vulnerabilityscanners.html
84 lines (80 loc) · 6.48 KB
/
vulnerabilityscanners.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
<html>
<meta name=”robots” content=”noindex,nofollow”/>
<a href=index.html>Back to home</a>
<hr/>
<h1>Vulnerability scanners</h1>
<p>I like to work with metasploit, db_nmap etc. in combination with <a target=_blank href=https://digistam.github.io/method/nmap_cve.html>CVE detection</a>, however
i find the results very unclear at times. In order to have a good overview of vulnerabilities on my network(s) I have installed two virtual machines:</p>
<p><ol>
<ul><a target=_blank href=https://www.greenbone.net/en/testnow/>Greenbone Enterprise Trial</a></ul>
<ul><a target=_blank href=https://www.tenable.com/products/nessus/nessus-essentials>Nessus Essentials</a></ul>
</ol></p>
<p>I compared the results of both vulnerability scanners to see which one is best for my situation.</p>
<h2>Greenbone</h2>
<p>I like to call this one <b>OpenVAS</b>. There are no limits with regard to the amount of IP addresses you can scan. It works fine with (bridged) VMware workstation. Standard
login is admin:admin. It was not clear to me how to <a target=_blank href=https://docs.greenbone.net/GSM-Manual/gos-21.04/en/managing-gos.html#performing-a-feed-update>update the feeds</a>.
It turned out the feed server was not reachable at all from my VMware machine. To make a long story short: I downloaded and installed the trial version of the Enterprise version,
and I would like to have the <a target=_blank href=https://greenbone.github.io/docs/latest/22.4/container/index.html>Greenbone Community Edition</a>, because I will never pay for
a commercial version.</p>
<h2>Install Greenbone Community Edition in Kali</h2>
<p>I found out it is best to install the free OpenVAS on the Kali machine. When it's running on localhost, it's possible to use it in Metasploit :-) When it's running in
separate VMware, Metasploit can't connect to it. So, in my situation I have the trial of the Greenbone Enterprise edition on separate VMware and I have free OpenVAS on my Kali machine as localhost.</p>
<p><ol>
<ul><i>sudo apt-get update</i></ul>
<ul><i>sudo apt install gvm</i></ul>
<ul><i>sudo gvm-setup</i></ul>
<ul><i>sudo gvm-check-setup</i></ul>
<ul>visit https://localhost:9392 and log in</ul>
<ul>verify the feed status before the first scan</ul>
</ol></p>
<p>Installing OpenVAS is very easy. The already existing postgresql database is used, this is great when working with Metasploit. Downloading the updated feeds take a long while:</p>
<p><ol>
<ul><a target=_blank href=http://feed.community.greenbone.net/community/vulnerability-feed/22.04/vt-data/notus/>Notus</a> (Notus scanner files)</ul>
<ul><a target=_blank href=http://feed.community.greenbone.net/community/vulnerability-feed/22.04/vt-data/nasl/>NASL</a> (OpenVAS scanner files)</ul>
<ul>SCAP data (CPE and CVE info)</ul>
<ul>CERT data (German DFN-CERT and CERT-Bund info)</ul>
<ul>GVMD data (scan configurations, compliance policies, port lists and report formats)</ul>
</ol></p>
<p>At the end of the install a password is automatically created, take notice of this !</p>
<p>After installation and install check with <i>sudo gvm-check-setup</i> you can go to https://localhost:9392, log in with username admin and the password assigned to you by the system.
First thing to do is go to Administration > Feed status and watch the feed that will be updating ... Wait for status: Current</p>
<p>If necessary, you can start and stop all services:</p>
<p><ol><ul>Start all services -> sudo gvm-start</ul>
<ul>Stop all services -> sudo gvm-stop</ul>
</ol></p>
<h2>Configure Remote Access To The Web Interface</h2>
<p>By default Greenbone Community Edition is installed with only localhost access to the GSA web interface. This means Greenbone Community Edition can only be accessed via the IP address 127.0.0.1.
To enable remote access to the web interface, the gsad systemd service file must be modified and the gsad service must be restarted.</p>
<p>Edit the contents of the gsad.service systemd service file:</p>
<p><ol>
<ul>Use nano to edit the gsad.sevice file</ul>
<ul><i>sudo nano /usr/lib/systemd/system/gsad.service</i></ul>
<ul>Change the value of the --listen argument to 0.0.0.0 and optionally change the value of --port to the standard SSL/TLS port 443:</ul>
<ul>Change this line: <i>ExecStart=/usr/local/sbin/gsad --foreground --listen=127.0.0.1 --port=9392</i></ul>
<ul>Into this: <i>ExecStart=/usr/local/sbin/gsad --foreground --listen=0.0.0.0 --port=443</i></ul>
<ul>Restart the gsad service:</ul>
<ul><i>sudo systemctl daemon-reload</i></ul>
<ul><i>sudo systemctl restart gsad</i></ul>
</ol></p>
<p>Unfortunately, it's not possible to connect to OpenVAS from Metasploit at the moment, several bug reports have already been sent to the programmer.</p>
<h2>Performing a Feed Synchronization</h2>
<p>For the actual vulnerability scanning, Vulnerability Test scripts, security information like CVEs, port lists and scan configurations are required.
All this data is provided by the Greenbone Community Feed and should be downloaded initially before starting the services.</p>
<p>A synchronization always consists of two parts:</p>
<p><ol>
<ul>Downloading the changes via rsync</ul>
<ul>Loading the changes into memory and a database by a daemon</ul>
</ol></p>
<p>Both steps may take a while, from several minutes up to hours, especially for the initial synchronization.
Only if both steps are finished, the synchronized data is up-to-date and can be used.</p>
<p>The first step is done via the greenbone-feed-sync script. The second step is done automatically when the daemons are started.</p>
<p><ol>
<ul>Downloading the data:</ul>
<ul><i>sudo /usr/local/bin/greenbone-feed-sync</i></ul>
</ol></p>
<h2>Pros and cons</h2>
<p>When installing and working with OpenVAS there are several pros and cons. Unfortunately, installing OpenVAS on Kali didn't work well with Metasploit. Also,
scanning was very heavy for my VMware system and the RAM memory. I don't like the fact that it runs on the same system as my Kali, so I really want to use
OpenVAS from a separate VMware machine. Unfortunately, I had a lot of problems updating the feed of the Greenbone Enterprise Trail version I had running on
a separate VMware machine. I really hate it when the feed is not updated and I can't have that. So, after some thoughts I will now download a fresh Debian ISO and
install OpenVAS community edition in a new VMware environment.</p>