performing-authenticated-scan-with-openvas

name	performing-authenticated-scan-with-openvas
description	Configure and execute authenticated vulnerability scans using OpenVAS/Greenbone Vulnerability Management with SSH and SMB credentials for comprehensive host-level assessment.
domain	cybersecurity
subdomain	vulnerability-management
tags	["openvas","gvm","authenticated-scan","vulnerability-scanning","greenbone","network-security","credentialed-scan"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"]

Performing Authenticated Scan with OpenVAS

Overview

OpenVAS (Open Vulnerability Assessment Scanner) is the scanner component of the Greenbone Vulnerability Management (GVM) framework. Authenticated scans use valid credentials (SSH for Linux, SMB for Windows, ESXi for VMware) to log into target systems, enabling detection of local vulnerabilities, missing patches, and misconfigurations that unauthenticated scans cannot identify. Authenticated scans typically find 10-50x more vulnerabilities than unauthenticated scans.

When to Use

• When conducting security assessments that involve performing authenticated scan with openvas
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Detection Gaps & Validation

• Auth silently failing — a completed scan with sparse local findings usually means bad credentials. Validate via the SSH/SMB authentication NVTs (e.g., OID ...103591 / ...90023).
• Wrong port list / alive test — hosts get dropped before scanning. Validate the scanned-host count equals the target list.
• SMB privilege level — non-admin Windows credentials miss patch state. Validate with an admin-equivalent service account.
• Stale feed — validate the NVT feed synced so recent CVEs are tested.
• ESXi/network credentials — hypervisor and device checks are skipped without their own credentials; validate each credential type used in scope.
• QoD-driven noise — validate high-severity results against installed versions to cut false positives.

Prerequisites

• GVM 22.x+ installed (gvmd, openvas-scanner, gsad, ospd-openvas)
• PostgreSQL database configured for gvmd
• Redis configured for openvas-scanner
• NVT feed synchronized (greenbone-nvt-sync or greenbone-feed-sync)
• SSH credentials for Linux targets or SMB credentials for Windows targets
• Network access to target hosts on scan ports

Installation

Install GVM on Kali Linux / Debian

# Install GVM package
sudo apt update && sudo apt install -y gvm

# Run initial setup (creates admin account, syncs feeds)
sudo gvm-setup

# Check installation status
 gvm-check-setup


 gvm-start