Exploring the OpenVAS vulnerability scanner
Validating Your Results
As with most automated procedures that haven't been tuned, the danger of false positives is revealed in the first few OpenVAS scans. The technical staff should analyze each issue to determine whether the item is a false positive. This analysis usually consists of verifying that a reported service is, in fact, running on an open port and is responding. Sometimes false positives are the result of the technical staff modifying the software locally, such as when vendors back-port patches into a supported version of a package. If possible, the quickest way to validate your results is to compare the version of the software running on the remote system against versions listed in the various vulnerability databases.
If the results appear valid, your next step might be simply to trust OpenVAS and follow the recommendations given in the report, which could entail disabling a server or service. However, if you're feeling inquisitive, you might want to recreate the issue manually to better understand the context.
Writing Plugins In NASL
Like Nessus, OpenVAS lets you create your own plugins for custom security checks with the Nessus Attack Scripting Language (NASL). See the NASL Reference Guide, which is available online [3] for more on working with NASL. Listing 1 addresses a few of the basic features you'll need to address when working with NASL.
In Listing 1, the description block holds metadata about the plugin, including a description of the vulnerability, details about the plugin category, and information on any dependencies the script might have. In this case, you can see that the check is for CVE-2009-3023, a stack overflow that was reported in Microsoft's IIS FTP server.
Listing 1
Building an NASL Plugin
Below the description block is a definition of the check itself. As you can see, the script checks to see that the specified port is open and then makes a call to the internal knowledge base to ensure that a writable directory is detected by the dependency plugin ftp_writeable_directories.nasl. If this is the case, the script then connects to the port and fetches the FTP banner. Once it has a banner, it compares the banner against known vulnerable versions and reports as necessary. The check knows that version 5.0 is definitely vulnerable, so it reports a hole in this case, but in other cases where Microsoft FTP server is running, a warning is issued.
The code in Listing 1 is a fairly simple example of a NASL script. NASL is a domain-specific language with a lot of security-specific functions. Although some questioned Tenable's decision to implement a whole new language, NASL is designed to be secure and provide the tools necessary to check even quite complex vulnerabilities. The NASL language includes built-in functions for packet crafting, packet capture, and many other useful tasks.
Conclusions
OpenVAS is a valuable tool for managing vulnerabilities. Although a tool like OpenVAS is very useful for identifying potential issues in targets and products, it is up to the technical staff to act on the reports and resolve the issues.
Infos
- Nessus: http://www.nessus.org/nessus/
- OpenVAS: http://www.openvas.org/
- NASL Reference Guide: http://www.virtualblueness.net/nasl.html
« Previous 1 2 3
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
Canonical Bumps LTS Support to 12 years
If you're worried that your Ubuntu LTS release won't be supported long enough to last, Canonical has a surprise for you in the form of 12 years of security coverage.
-
Fedora 40 Beta Released Soon
With the official release of Fedora 40 coming in April, it's almost time to download the beta and see what's new.
-
New Pentesting Distribution to Compete with Kali Linux
SnoopGod is now available for your testing needs
-
Juno Computers Launches Another Linux Laptop
If you're looking for a powerhouse laptop that runs Ubuntu, the Juno Computers Neptune 17 v6 should be on your radar.
-
ZorinOS 17.1 Released, Includes Improved Windows App Support
If you need or desire to run Windows applications on Linux, there's one distribution intent on making that easier for you and its new release further improves that feature.
-
Linux Market Share Surpasses 4% for the First Time
Look out Windows and macOS, Linux is on the rise and has even topped ChromeOS to become the fourth most widely used OS around the globe.
-
KDE’s Plasma 6 Officially Available
KDE’s Plasma 6.0 "Megarelease" has happened, and it's brimming with new features, polish, and performance.
-
Latest Version of Tails Unleashed
Tails 6.0 is based on Debian 12 and includes GNOME 43.
-
KDE Announces New Slimbook V with Plenty of Power and KDE’s Plasma 6
If you're a fan of KDE Plasma, you'll be thrilled to hear they've announced a new Slimbook with an AMD CPU and the latest version of KDE Plasma desktop.
-
Monthly Sponsorship Includes Early Access to elementary OS 8
If you want to get a glimpse of what's in the pipeline for elementary OS 8, just set up a monthly sponsorship to help fund its continued existence.