OpenVAS Vulnerability
Assessment

🎯 Project Overview

This project involved conducting a comprehensive vulnerability analysis of a virtualised network using OpenVAS (Open Vulnerability Assessment System) — an open-source framework maintained by Greenbone Networks. The assessment targeted three guest machines running within VMware Workstation Player on the subnet 192.168.244.0/24.

The project simulates a real-world internal network audit, providing practical experience in configuring a scanner, interpreting vulnerability feeds, and producing actionable mitigation reports — skills directly aligned with the VAPT modules I now teach at university level.

🔍 Why It Was Built

Regular vulnerability assessments are a cornerstone of proactive network defence. This project was designed to demonstrate end-to-end competency in: setting up a realistic target environment, configuring OpenVAS with updated security feeds, running authenticated and unauthenticated scans, and presenting findings in a structured, actionable format.

It also serves as a teaching artefact — providing students with a realistic example of what a professional vulnerability assessment workflow looks like from setup to report.

🖥️ Network Environment

The virtualised lab was structured as follows:

• Hypervisor: VMware Workstation Player
• IP Range: 192.168.244.0/24
• Target 1: Linux Mint (general desktop Linux)
• Target 2: Metasploitable (intentionally vulnerable machine)
• Target 3: Cyberops Workstation

OpenVAS was configured with fully updated feeds prior to the scan, including CVE, CPE, NVT, SCAP, CERT advisories, and compliance policies — ensuring comprehensive detection coverage.

🐛 Vulnerabilities Detected

The scan successfully identified vulnerabilities across six major categories:

Vulnerability Type	Severity	Description
End of Life (EOL) Software	HIGH	Unsupported software versions lacking security patches
Cross-Site Scripting (XSS)	HIGH	Script injection possible on web-facing applications
Default Credentials	HIGH	Systems using factory default username/password pairs
File Inclusion Vulnerabilities	MEDIUM	Arbitrary file inclusion allowing malicious execution
Injection Vulnerabilities (SQL)	MEDIUM	Unsanitised inputs allowing database query manipulation
Cross-Site Request Forgery (CSRF)	LOW	Authenticated users tricked into unintended actions

🛠️ Setup & Usage

The project workflow consisted of four phases:

1. Environment Setup — Deployed three VMs in VMware; configured network adapters to share a common subnet.
2. OpenVAS Configuration — Updated all vulnerability feeds (NVT, CVE, CPE, SCAP, CERT); created a scan target covering the entire /24 subnet.
3. Scan Execution — Ran a full and fast scan policy against all three hosts; collected XML and HTML reports.
4. Analysis & Reporting — Reviewed each finding by severity, identified affected components, and produced mitigation recommendations.

# Example: Update OpenVAS feeds
sudo greenbone-feed-sync --type GVMD_DATA
sudo greenbone-feed-sync --type SCAP
sudo greenbone-feed-sync --type CERT

# Start OpenVAS scanner
sudo gvm-start

✅ Mitigation Recommendations

• EOL Software: Upgrade to actively supported versions or migrate to maintained alternatives.
• XSS: Implement input validation, output encoding, and Content Security Policy (CSP) headers.
• Default Credentials: Enforce unique, strong passwords at provisioning; implement MFA where possible.
• File Inclusion: Validate and whitelist all user inputs; avoid dynamic file includes based on user parameters.
• SQL Injection: Use prepared statements and parameterised queries throughout the application layer.
• CSRF: Implement anti-CSRF tokens in all state-changing forms; use SameSite cookie attributes.

📸 Screenshots

Screenshots from the project are available in the GitHub repository and the linked YouTube walkthrough. Below are placeholder frames representing key stages of the assessment.