Openvas

OpenVAS / Greenbone Community Edition

Network and service vulnerability scanner — 90,000+ NVTs, CVEs, misconfigs, compliance.

Architecture

GSA (Web UI :9392) ─→ gvmd ─→ ospd-openvas ─→ openvas-scanner
                       │                             │
                  PostgreSQL                      Redis (NVT cache)

Components: gvmd (manager daemon), ospd-openvas (OSP wrapper), openvas (scanner), gsa (web UI), notus-scanner (fast CVE checks via JSON advisories).

Deploy (Docker — Greenbone Community Edition)

# Download compose file
curl -f -O https://greenbone.github.io/docs/latest/_static/docker-compose-22.4.yml

# Start all services
docker compose -f docker-compose-22.4.yml -p greenbone-community-edition pull
docker compose -f docker-compose-22.4.yml -p greenbone-community-edition up -d

# Wait for feed sync (can take 30-60 min first time)
docker compose -f docker-compose-22.4.yml -p greenbone-community-edition \
    logs -f vulnerability-tests

# Default credentials: admin / admin
# Web UI: https://127.0.0.1:9392

GSA Web UI Scan Workflow

1. Configuration → Credentials    # Optional: SSH/SMB creds for authenticated scan
2. Configuration → Targets        # Create target (hosts/subnet, port list)
3. Configuration → Scan Configs   # Choose config (see table)
4. Scans → Tasks → New Task       # Bind target + config + optional credentials
5. ▶ Start Task                   # Execute
6. Scans → Reports → select       # View findings; export XML/CSV/PDF

Scan Configurations

gvm-cli (Command Line)

# Install
pip install gvm-tools

# Auth alias — add to shell profile
alias gvmcli='gvm-cli --gmp-username admin --gmp-password admin \
    socket --socketpath /run/gvmd/gvmd.sock --xml'

# Test connectivity
gvmcli '<get_version/>'

# List targets
gvmcli '<get_targets/>'

# List tasks
gvmcli '<get_tasks/>'

# Get results for task
gvmcli '<get_results task_id="TASK_ID"/>'

# Get report (XML)
gvmcli '<get_reports report_id="REPORT_ID" filter="apply_overrides=0 min_qod=70"/>'

Create Scan via CLI

# 1. Create target
gvmcli '<create_target>
  <name>My Target</name>
  <hosts>192.168.1.0/24</hosts>
  <port_list id="33d0cd82-57c6-11e1-8ed1-406186ea4fc5"/>
</create_target>'
# → note target id from response

# 2. Create task
gvmcli '<create_task>
  <name>Scan Task</name>
  <target id="TARGET_ID"/>
  <config id="daba56c8-73ec-11df-a475-002264764cea"/>
</create_task>'
# → note task id from response

# 3. Start task
gvmcli '<start_task task_id="TASK_ID"/>'

# 4. Check status
gvmcli '<get_tasks task_id="TASK_ID"/>'
# Look for: <status>Running</status> or <status>Done</status>

Port List IDs

gvm-pyshell (Python Scripting)

gvm-pyshell --gmp-username admin --gmp-password admin \
    socket --socketpath /run/gvmd/gvmd.sock

# In shell:
>>> targets = gmp.get_targets()
>>> tasks = gmp.get_tasks()
>>> gmp.start_task(task_id='TASK_ID')

Useful Filters

# Results with severity >= 7.0, QoD >= 70
gvmcli '<get_results filter="severity>7 min_qod=70 sort-reverse=severity"/>'

# Only active CVEs
gvmcli '<get_nvts filter="type=cve"/>'

Feed Update (Manual)

# In Docker deployment
docker compose exec ospd-openvas greenbone-nvt-sync
docker compose exec gvmd greenbone-feed-sync --type GVMD_DATA
docker compose exec gvmd greenbone-feed-sync --type SCAP
docker compose exec gvmd greenbone-feed-sync --type CERT

Common Troubleshooting

QoD (Quality of Detection)

Filter min_qod=70 eliminates most false positives.

References

• Greenbone Community Docs
• GMP XML Protocol Reference
• Scan configs and port list IDs: references/scan-configs.md