OpenVAS Open Vulnerability Scanning Free your vulnerabilities! - - PowerPoint PPT Presentation
LinuxCon #1 OpenVAS Open Vulnerability Scanning Free your vulnerabilities! Vlatko Koturjak | kost@linux.hr 1 LinuxCon #1, 2009-09-22, Portland, Oregon, USA Agenda Nessus Free alternatives Free feed(s) Oval interpreters,
1
Vlatko Košturjak | kost@linux.hr LinuxCon #1, 2009-09-22, Portland, Oregon, USA
Nessus Free alternatives
Free feed(s) Oval interpreters, Nmap OpenVAS
OpenVAS state && differencies OpenVAS practical tips OpenVAS future Q&A
Nessus was free once...
4
http://linuxhow2.com/News/80_of_Software_Will_Be_Open_source.html
OVAL interpreters ovaldi
Reference implementation
OVAL
Open Vulnerability Assessment language XML http://oval.mitre.org
Good for local checks if you find needed
Version 5 released recently Has scripting support
NSE = Nmap Scripting Engine Yes, that Lua thingy Basic misconfiguration checks Enumeration checks Basic vulnerabilties check
Missing reporting functions No severities / risk ratings
Nessus GPL fork, Old name: Gnessus Continues open development of
But OpenVAS follows its own path!
Both local and remote checks are
Reportings Risk rating ...
GPL (v2) license Open development Software in Public Interest (SPI) Change requests Democratic voting Open in every sense
Your new idea? OpenVAS DevCon IRC
Take advantage of organization
Tools integration
Practice what you preach!
Flawfinder, ... Enforce security options in compiler
Versions:
1.x = Nessus compatible (NTP protocol) 2.x = Nessus incompatible (OTP protocol)
IANA
Released 17th of December, 2008 What's new?
Initial OVAL support NTP => OTP script_id => script_oid 64 bit support GUI client improved Bugfixes Code audit ...
OpenVAS got from Nessus:
OpenVAS additionaly integrates with:
It's not Debian local checks only
You have checks for popular BSD Oses and
Linux distros
Windows as well Solaris (experimental?)
You miss SMB*inc checks
Smb functions are rewritten
not compatible with old ones
There is only few left which needs to be
rewritten using free smb libraries
Help us to rewrite it
It's not single language any more NVT = Network Vulnerability Test Plugins == NVTs "Languages"
NASL (got from Nessus) OVAL (implemented in 2.x) NSE (planned)
Nessus Attack Script Language (NASL) Inherited from Nessus Language still the same
Removed plugin localization There is few functions added Same syntax
if (description) { } # script code
script_id => script_oid
Implemented in 2.x Using ovaldi OVAL checks appear in Plugins and
Local checks
Nmap scripting Engine (NSE) Lua Phase: planning
Choose .nse you like from OpenVAS
Options
nmap=>libnmap Not system/execve
Current / memory problem
09/09/08 10/29/08 12/18/08 02/06/09 03/28/09 05/17/09 07/06/09 08/25/09 10/14/09 2000 4000 6000 8000 10000 12000 14000
Use local checks (if possible)
Use SSH keys for better security Harden security of scanning box
Port scans
Nmap
Do port scan with nmap first Feed it to OpenVAS (grepable results)
Portbunny
Kernel level port scanner Not bad for internal scans
Full audit
1-65535 ports Thorough tests
Report verbosity Report paranoia Knowledgebase (kb)
Something like --verbose Save to disk Analyze findings at deep tech level
Take a look at current change requests Virtual hosts support Windows local checks
Drop existing NASL implementation Using WMI
Linux/Unix local checks
Drop existing NASL implementation Using SSH library
current future
OpenVAS virtual appliances
Vmware, VirtualBox, ...
OpenVAS in backtrack
http://www.openvas.org/openvas-bt.html Backtrack 3
Not included by default Check URL above for remastered ISO image
Backtrack 4
Beta version doesn't ship with OpenVAS Prefinal version comes with OpenVAS
Autonessus
Diff between two scans Supports OpenVAS and Nessus Time for name change? :)
Metasploit
Some initial development done OpenVAS as client
HD Moore "weekend hack"
Better: metasploit as OpenVAS client
Ecosystem around OpenVAS
Trainings Commercial support Commercial NVT feeds
OIDs
Enables vendors to have different address
space each
i.e. 1.2.3.4.x.x
Extending scanning engine Extending vulnerability coverage Writting Vulnerability tests (NVTs)
Write your PoC/test for OpenVAS!
Translating Documentation writting (compendium) Administration (web, irc, ...) http://www.openvas.org
Open, open and open Multiple vulnerability tests Open Vulnerability Assessment language
(OVAL)
Nessus Attack Scripting Language (NASL) Nmap Scripting Engine (NSE) – early dev Integrated tools Port scanning: portbunny, strobe, pnscan... Enumeration: ike-scan, snmpwalk, ... SLAD: john, chkrootkit, clamav, lsof, tripwire, ..
http://www.openvas.org http://www.ohloh.net/p/openvas http://www.twitter.com/openvas http://www.identi.ca/openvas openvas-announce Openvas-discuss Openvas-devel irc.oftc.net #openvas