How does OpenVAS scanner work?
OpenVAS is a fork of the old Nessus scanner, performed in 2005 when Nessus became a commercial product. OpenVAS is currently
developed and maintained by
Greenbone Networks with support from the community.
OpenVAS implements each test in a plugin called NVT (Network Vulnerability Test) which is written in a scripting language called NASL (
Nessus Attack Scripting Language). It currently has more than 57000 active plugins which can detect a huge number of vulnerabilities for numerous services and applications.
For instance, here is how one simple NVT looks like. It is called
fortigate_detect.nasl and it tells if the target device is a Fortigate Firewall:
#
# This script was written by David Maciejak
# This script is released under the GNU GPL v2
#
if(description)
{
script_id(17367);
script_name("Fortinet Fortigate console management detection");
script_family("General");
script_dependencies("http_version.nasl");
script_require_ports(443);
exit(0);
}
#
# The script code starts here
#
include("http_func.inc");
function https_get(port, request)
{
if(get_port_state(port))
{
soc = open_sock_tcp(port, transport:ENCAPS_SSLv23);
if(soc)
{
send(socket:soc, data:string(request,"\r\n"));
result = http_recv(socket:soc);
close(soc);
return(result);
}
}
}
port = 443;
if(get_port_state(port))
{
req1 = http_get(item:"/system/console?version=1.5", port:port);
req = https_get(request:req1, port:port);
#<title>Fortigate Console Access</title>
if("Fortigate Console Access" >< req)
{
security_note(port);
}
}
OpenVAS Scanning Policy
While OpenVAS has multiple predefined policies, our scanner uses the one called
Full and Fast. This policy uses the majority of the NVTs and it is optimized to use the information collected by the previous plugins. For instance, if a previous plugin detects the FTP service running on port 2121, it will run all the FTP related plugins on that port. Otherwise it won't.
Open Ports Detection
We have configured OpenVAS to scan for a default list of ports containing the most common 6000 ports (TCP and UDP).
However, please note that the scanner first attempts to detect if the host is alive or not before doing the port scan. If the host is not alive (ex. does not respond to ICMP requests) it will show zero open ports found.
Note: If the scanner does not find any open ports even though you know there are, we recommend you re-running the scan with the option "Check if host is alive" disabled. This will skip host discovery and just start the port scan.
How long does an OpenVAS scan take?
Since the OpenVAS scanner performs a considerable number of tests, the full scan can take from 30 minutes to several hours.
It highly depends on the number of open ports found on the target host. As this number is larger, the scanning time increases because OpenVAS will have to run a higher number of NVTs.
