OPENVAS ================================================================= OPENVAS ================================================================= Able to detect tens of thousands of vulnerabilities. openvas comes pre-installed with Kali however it does require several initial steps in order to get it up and running properly. #openvas-setup MAKE SURE TO WRITE DOWN THE USERNAME AND PASSWORD GENERATED AT THE END OF SETUP! #openvas-start??? Web Interface for openvas https://127.0.0.1:9392 We can also launch this with: #firefox https://127.0.0.1:9392 Login with the username 'admin' and the password that was generated in the setup process. Before we can run our first vulnerability scan, we need to define our target. Tis can be a single IP address or a range of hosts. With the target configured we can proceed to create a new scan task from the scan management menu, using one of the built in scan configs. Once the scan has finished, the scan report can be found under the Reports section of the scan managemen menu. When scanning without credentials, we are unable to query software installed on te target or other vulnerabilities that require an authenticated scan. Inspect the settings and configurations before starting a scan. CONFIGURATION --> SCAN CONFIGS Take some time to check out the scan configurations You can run a Quick Scan using a default setup. Multiple IPs can be separated with a comma. SCAN MANAGEMENT It is possible to be warned of vulnerabilities that do not exist! Alternatively vulnerability scanners may miss a vulnerability all-together. Sometimes an exploit will exist for a known vulnerability. Other scanners include: Nessus Retina Qualys nextpose?