aeondave/openvas

OpenVAS / Greenbone Community Edition

Network and service vulnerability scanner — 90,000+ NVTs, CVEs, misconfigs, compliance.

Architecture

GSA (Web UI :9392) ─→ gvmd ─→ ospd-openvas ─→ openvas-scanner
                       │                             │
                  PostgreSQL                      Redis (NVT cache)

Components: gvmd (manager daemon), ospd-openvas (OSP wrapper), openvas (scanner), gsa (web UI), notus-scanner (fast CVE checks via JSON advisories).

Deploy (Docker — Greenbone Community Edition)

# Download compose file
curl -f -O https://greenbone.github.io/docs/latest/_static/docker-compose-22.4.yml

# Start all services
docker compose -f docker-compose-22.4.yml -p greenbone-community-edition pull
docker compose -f docker-compose-22.4.yml -p greenbone-community-edition up -d

# Wait for feed sync (can take 30-60 min first time)
docker compose -f docker-compose-22.4.yml -p greenbone-community-edition \
    logs -f vulnerability-tests

# Default credentials: admin / admin
# Web UI: https://127.0.0.1:9392

GSA Web UI Scan Workflow

1. Configuration → Credentials    # Optional: SSH/SMB creds for authenticated scan
2. Configuration → Targets        # Create target (hosts/subnet, port list)
3. Configuration → Scan Configs   # Choose config (see table)
4. Scans → Tasks → New Task       # Bind target + config + optional credentials
5. ▶ Start Task                   # Execute
6. Scans → Reports → select       # View findings; export XML/CSV/PDF

Scan Configurations

| Config | ID | Use | |--------|----|-----| | Full and Fast | daba56c8-73ec-11df-a475-002264764cea | Standard pentest scan | | Full and Deep | 698f691e-7489-11df-9d8c-002264764cea | Slower, more thorough | | Empty | 085569ce-73ed-11df-83c3-002264764cea | Base for custom configs | | Discovery | 8715c877-47a0-438d-98a3-27c7a6ab2196 | Port/service discovery only | | Host Discovery | 2d3f051c-55ba-11e3-bf43-406186ea4fc5 | Ping sweep only | | System Discovery | bbca7412-a950-11e3-9109-406186ea4fc5 | OS/service fingerprinting |

gvm-cli (Command Line)

# Install
pip install gvm-tools

# Auth alias — add to shell profile
alias gvmcli='gvm-cli --gmp-username admin --gmp-password admin \
    socket --socketpath /run/gvmd/gvmd.sock --xml'

# Test connectivity
gvmcli '<get_version/>'

# List targets
gvmcli '<get_targets/>'

# List tasks
gvmcli '<get_tasks/>'

# Get results for task
gvmcli '<get_results task_id="TASK_ID"/>'

# Get report (XML)
gvmcli '<get_reports report_id="REPORT_ID" filter="apply_overrides=0 min_qod=70"/>'

Create Scan via CLI

# 1. Create target
gvmcli '<create_target>
  <name>My Target</name>
  <hosts>192.168.1.0/24</hosts>
  <port_list id="33d0cd82-57c6-11e1-8ed1-406186ea4fc5"/>
</create_target>'
# → note target id from response

# 2. Create task
gvmcli '<create_task>
  <name>Scan Task</name>
  <target id="TARGET_ID"/>
  <config id="daba56c8-73ec-11df-a475-002264764cea"/>
</create_task>'
# → note task id from response

# 3. Start task
gvmcli '<start_task task_id="TASK_ID"/>'

# 4. Check status
gvmcli '<get_tasks task_id="TASK_ID"/>'
# Look for: <status>Running</status> or <status>Done</status>

Port List IDs

| Port List | ID | |-----------|-----| | All IANA Assigned TCP | 33d0cd82-57c6-11e1-8ed1-406186ea4fc5 | | All TCP and Nmap Top 100 UDP | 730ef368-57e2-11e1-a90f-406186ea4fc5 | | All TCP | fd591a34-56fd-11e1-9f27-406186ea4fc5 |

gvm-pyshell (Python Scripting)

gvm-pyshell --gmp-username admin --gmp-password admin \
    socket --socketpath /run/gvmd/gvmd.sock

# In shell:
>>> targets = gmp.get_targets()
>>> tasks = gmp.get_tasks()
>>> gmp.start_task(task_id='TASK_ID')

Useful Filters

# Results with severity >= 7.0, QoD >= 70
gvmcli '<get_results filter="severity>7 min_qod=70 sort-reverse=severity"/>'

# Only active CVEs
gvmcli '<get_nvts filter="type=cve"/>'

Feed Update (Manual)

# In Docker deployment
docker compose exec ospd-openvas greenbone-nvt-sync
docker compose exec gvmd greenbone-feed-sync --type GVMD_DATA
docker compose exec gvmd greenbone-feed-sync --type SCAP
docker compose exec gvmd greenbone-feed-sync --type CERT

Common Troubleshooting

| Symptom | Fix | |---------|-----| | Scan stuck at 0% | Check scanner registered: gvmcli '<get_scanners/>' | | Feed empty / old NVTs | Run greenbone-nvt-sync manually | | GSA unreachable | Check port 9392 and SSH tunnel if remote | | Scan very slow | Use "Full and Fast" not "Full and Deep"; reduce concurrent hosts | | Low QoD results | Filter with min_qod=70 (confirmed findings only) |

QoD (Quality of Detection)

| QoD | Meaning | |-----|---------| | 100% | Package version check (most reliable) | | 70%+ | Active exploit confirmation | | 50% | Remote banner check | | 30% | Unreliable/indirect detection |

Filter min_qod=70 eliminates most false positives.

References

• Greenbone Community Docs
• GMP XML Protocol Reference
• Scan configs and port list IDs: references/scan-configs.md