20. Vulnerability Scanning and Assessment

20.4 OpenVAS / Greenbone: Full Vulnerability Scanning

By Ravindra Bagale Last updated: 27 September 2026

OpenVAS (now part of Greenbone Community Edition) is a free, full vulnerability scanner. It has tens of thousands of tests (called NVTs) and checks versions, configurations and weak settings, then gives a report with CVSS scores and fixes. Commercial tools like Nessus and Qualys work in a similar way.

Install on Kali (needs about 4 GB RAM for the Kali VM and time to download the feeds):

sudo apt update && sudo apt install -y gvm      # Kali is Debian-based, so it uses apt, not yum
sudo gvm-setup                                   # first-time setup; downloads feeds (can take a long time)
                                                 # note the admin password printed at the end
sudo gvm-check-setup                             # verifies everything is ready
sudo gvm-start                                   # start the services

Open https://127.0.0.1:9392 in Firefox inside Kali and log in as admin with the printed password.

Run a scan:

Configuration, Targets, New Target: name Metasploitable2, hosts 192.168.56.20.
Scans, Tasks, New Task: choose the target and the scan config Full and fast.
Start the task and wait (20–60 minutes for one host).
Open the Report: results are sorted by severity, each with a description, affected versions, CVEs and a Solution section.

Scanners can break things

Some checks send unusual data that may crash old services. That is why we scan only a lab VM with a snapshot. In a real job, full scans are agreed in the scope document and often run in a maintenance window.

Ravindra Bagale's Tip

gvm-setup takes a long time, and students shut down the VM in the middle – then the setup breaks. Go and have a cup of tea, but don't stop it! Also, if the Kali VM has too little RAM, the scanner hangs. Give it at least 4 GB.

Ravindra Bagale's Tip – मराठी

gvm-setup ला खूप वेळ लागतो आणि students मधेच VM बंद करतात – मग setup तुटतो. चहा घेऊन या, पण थांबवू नका! आणि Kali VM ला कमी RAM दिली तर scanner hang होतो. कमीत कमी 4 GB द्या.

Ravindra Bagale's Tip – हिंदी

gvm-setup में बहुत समय लगता है और students बीच में ही VM बंद कर देते हैं – फिर setup टूट जाता है. चाय पीकर आओ, पर रोको मत! और Kali VM को कम RAM दी तो scanner hang हो जाता है. कम से कम 4 GB दो.

Lab

Install Greenbone on Kali, run a "Full and fast" scan against 192.168.56.20, and export the report as PDF. Count how many Critical, High, Medium and Low findings you got.