Welcome back!
We’ll start a series of lectures on Vulnerability Assessment Systems of VAS.
One of the keys to being a successful ethical hacker or penetration tester is the ability to find
vulnerabilities on the target systems in order to secure them. As you already know, a vulnerability
is a bug of an asset,that an taker can exploit to gain unauthorized access to sensitive data, inject
malicious code, or generate denial of service attacks. To prevent security breaches
it is important to identify and immediate security holes and vulnerabilities that can expose an asset
to an attack.
We took a look at several ways to do that, including various tools like and map, zenmap, routersploit
or metasploit. Even though they are great tools in finding vulnerabilities on different systems
a lot of human effort is needed in detecting and suggesting solutions for different vulnerabilities
and flaws.
A tool that detects, assesses, reports and integrates with other tools would be of great help.
Such a tool is called Generically Vulnerability Assessment System, or VAS, and is used by professional
penetration testers for both personal and enterprise networks
testing.
Most of them use common vulnerabilities and exposures or CVEs to run test cases for the vulnerability
testing on different infrastructures.
They use signatures of the discovered vulnerabilities
so it's important to update their database as quickly as possible for newly exposed vulnerabilities.
A VAS helps you to understand the cyber exposure of all assets, including vulnerabilities.
misconfigurations
and other security health indicators.
Let's see what vulnerability assessment systems are available on the market!
One of the first such products was Nessus which started in 1998 to provide
the Internet community with a free remote security scanner.
However in 2005, Tenable Network Security, the company that developed
Nessus, changed it to a proprietary, closed source license.
Nowadays, Nessus is one of the most well-known and used commercial VAS, especially by big networks
or corporations.
A one year license price starts from 3000 U.S. dollars, which is considered expensive for
individuals or small companies.
Note that there is also a trial version which is free of cost for personal use, you know, non-commercial
environment for a limited period of time.
After Nessus became a commercial software, a few pen testers created an open source and free fork
called OpenVAS.
Now OpenVAS is an open-source Vulnerability Manager (VM) and Vulnerability Assessment System (VAS), which
means it is free to use and its source code is
public as well.
It is licensed under GPL and although it is free, it is really good at its job and is in the list of
the top VAS.
In this section, we'll take a look at OpenVAS, which is a tool that scans the entire network
infrastructure for vulnerabilities and generates a scan report, which helps you to prioritize
vulnerabilities based on risk factor and determine the most effective solution to implement.
Another VAS is Nexpose which is developed by Rapid7, the same company that develops
Metasploit.
It also integrates with Metasploit so that it provides a vulnerability assessment and validation tool,
which helps you eliminate false positive, verify vulnerabilities and test remediation measures.
Nexpose camps in several versions, both commercial and free.
The Community Addition is a free and limited version of Nexpose, and it's the one someone should
start with. In order to install it
the first step is to create a free account at this address.
An e-mail address, other than a free one, is required and a license key that is valid for one year will
be emailed to that address.
Note that Vulnerability Assessment Systems are complex applications with lots of components and
require a lot of resources.
For example, the minimum requirements for Nexpose is 8GB of RAM, 16GB being the
recommended, and 100GB of free space on your disk.
On the other hand, OpenVAS does not require anything near that amount of memory,
but the more you can provide it, the smoother your scanning system will run.
Keep in mind that most of the problems, errors and crashes of VAS are due to insufficient resources
allocated. For our tests
I'd recommend you to allocate, if possible, 3-4 GB of RAM to the VM.
This was a short introduction to vulnerability assessment systems.
We'll take a short break
and in the next lectures, I'll show you how to install and use OpenVAS.