Lab: vulnerability scanning your lab with OpenVAS/Greenbone

Aim and what you need

The aim is to run a vulnerability scan the way a security team would: with a written scope, an up-to-date test feed, and a report that someone could act on. Vulnerability scanning checks systems for known weaknesses such as missing patches, weak settings and old protocols. It does not exploit anything, but it does send a lot of traffic and can crash fragile devices, so it is only done with permission.

• A Kali Linux VM with at least 4 GB RAM (8 GB is better) and 40 GB free disk, address 192.168.56.50.
• A target: a deliberately vulnerable VM such as Metasploitable 2 at 192.168.56.60, on a host-only or internal network with no internet route.
• Internet access for Kali during install and feed sync only. Allow two hours, mostly waiting for the feed.

Warning: never scan networks you do not own or have written permission to test, including your employer's or school's network. Unauthorised scanning can break computer misuse laws.

Steps

1. Write a one-line scope: "Scan 192.168.56.60 only, in my own lab, on this date."
2. Update Kali, install the gvm package and run the setup script. It downloads the feeds and prints an admin password at the end.
3. Check the setup, start the services and open the web interface at https://127.0.0.1:9392.
4. Under Configuration, Targets, create a target for 192.168.56.60 with the "All IANA assigned TCP" port list.
5. Under Scans, Tasks, create a task with the "Full and fast" scan configuration and start it.
6. Create a Credential (username and password for a test account on the target), add it to a copy of the target as SSH credentials and run a second, authenticated scan.
7. Export both reports as PDF or CSV.

sudo apt update && sudo apt full-upgrade -y
sudo apt install -y gvm
sudo gvm-setup
sudo gvm-check-setup
sudo gvm-start
sudo greenbone-feed-sync
sudo runuser -u _gvm -- gvmd --user=admin --new-password='<new-strong-password>'
sudo gvm-stop

How to verify and read the results

The scan worked if the report lists the target host with dozens of findings, each with a severity based on CVSS (Common Vulnerability Scoring System), a description, and a solution. Metasploitable is meant to be badly broken, so expect high-severity items such as outdated services and weak default credentials. The authenticated scan should show noticeably more findings, because the scanner can read installed package versions. For your report, do not just copy the list. Group the findings, pick the five most serious, and for each write the risk in one sentence, the evidence, and the fix (patch, disable the service or change the setting). Check whether a finding appears on the CISA Known Exploited Vulnerabilities list, as that raises its priority. Look out for false positives where a version banner was guessed, and mark them as such.

Troubleshooting and clean-up

• gvm-check-setup reports errors: it usually prints the exact fix command. Feed sync can take a long time on the first run; let it finish.
• Scan finishes instantly with no results: the target is down, unreachable, or the feed is still loading. Ping the target and check that the scan configurations list is populated.
• Web UI will not load: confirm services with sudo gvm-check-setup and use 127.0.0.1, not localhost, if the certificate complains.

Clean up by stopping the services, shutting down the vulnerable VM, and keeping it on its isolated network. Never bridge Metasploitable to your home network or the internet. Keep your two reports and a short write-up for your portfolio.