Lesson 5 of 12

Vulnerability Assessment

Vulnerability assessment bridges the gap between scanning and exploitation by identifying which discovered services have known weaknesses. You will use OpenVAS and Nessus to automate vulnerability discovery and learn to interpret CVSS scores to prioritize findings. Understanding severity ratings is essential for professional reporting.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

This is asking you to build a clear mental model of the concept — not just memorize a definition, but genuinely understand what it means, why it exists, and how it connects to everything else you are learning. When you can explain "the difference between vulnerability scanning and penetration testing" in your own words to someone who has never heard of it, you have truly learned it.

Why this matters

Scanning and reconnaissance are the foundation of every real-world penetration test. Before you can find or fix vulnerabilities, you need to know exactly what is running on a network. This is the skill that separates guesswork from methodical, professional security work.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Run a professional network scan against an authorized target, interpret the results to build a complete picture of the attack surface, and document your findings in a format that is useful for the next phase of testing.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

Vulnerability Assessment · Objective 1 of 4

VIDEO

Loading video…

Install and initialize OpenVAS on Kali Linux

OpenVAS (now part of Greenbone Vulnerability Manager) is a professional-grade vulnerability scanner used by security teams worldwide. Install it using apt, then run gvm-setup which downloads the vulnerability database — this initial setup takes 15-30 minutes and requires an internet connection. The setup script will display the auto-generated admin password at the end; copy it immediately because it is only shown once and you cannot retrieve it later without resetting it. After setup, start the services and wait 2-3 minutes for them to fully initialize before trying to access the web interface. If the setup fails partway through, run gvm-check-setup to diagnose what went wrong.

sudo apt install gvm -y && sudo gvm-setup && sudo gvm-start

Access the Greenbone web interface and log in

Open Firefox in Kali and navigate to https://127.0.0.1:9392 — you will see a certificate warning because the certificate is self-signed, which is expected for a local tool. Click Advanced and then Accept the Risk and Continue to proceed to the login page. Log in with username admin and the password from the setup step. If you forgot the password, run sudo gvmd --user=admin --new-password=newpassword to reset it. The dashboard shows scan status, recent results, and vulnerability statistics — take a few minutes to explore the interface before creating your first scan so you understand where everything is.

open https://127.0.0.1:9392

Create a scan target pointing to Metasploitable

In the Greenbone interface, go to Configuration > Targets and click the star icon to create a new target. Enter a descriptive name like Metasploitable Lab and enter your Metasploitable VM IP address in the Hosts field — double-check by pinging the target from Kali before saving to confirm the IP is correct. Leave the port list as All IANA assigned TCP for a comprehensive scan. You can also add credentials under the Credentials section for authenticated scanning, which finds significantly more vulnerabilities — for Metasploitable, the default credentials are msfadmin/msfadmin. A common mistake is entering the wrong IP address, which wastes 30-60 minutes scanning the wrong host.

ping -c 3 192.168.56.101

Configure and launch a Full and Fast vulnerability scan

Go to Scans > Tasks and click the star icon to create a new task. Select your Metasploitable target, choose Full and Fast as the scan config (this runs all enabled NVTs without overly aggressive checks that could crash services), and leave the schedule as Once. Click Save, then click the green play button next to your task to start the scan. The scan will take 20-60 minutes depending on the number of open services — you can monitor progress by clicking on the task, which shows percentage complete and the current host being scanned. Do not worry if the browser tab closes; the scan continues running on the server.

Analyze the vulnerability report by severity

After the scan completes, click on the task name to view the results, which are color-coded by severity: red (Critical, CVSS 9-10), orange (High, 7-8.9), yellow (Medium, 4-6.9), and blue (Low, 0.1-3.9). Click on any finding to see the full details: the CVE number, CVSS score, affected service, description of the vulnerability, and remediation advice. On Metasploitable, you should see dozens of Critical and High findings. A common mistake is focusing only on Critical findings — Medium vulnerabilities can often be chained together to achieve the same impact as a single Critical vulnerability, a technique called vulnerability chaining that is very common in real-world attacks.

Cross-reference findings with the NVD and Exploit-DB

For each Critical and High finding, copy the CVE number and search for it on nvd.nist.gov to read the full description, CVSS vector breakdown, and list of affected versions. Then search the same CVE on exploit-db.com to see if a public exploit exists — if one does, note whether it is a Metasploit module (easiest to use) or a standalone script (requires more manual work). This research process teaches you to think like an attacker: you are building a prioritized attack plan based on what is actually exploitable, not just what has the highest CVSS score. A high CVSS score with no public exploit is less immediately dangerous than a medium CVSS score with a reliable, weaponized Metasploit module.

open https://nvd.nist.gov && open https://www.exploit-db.com

Previous: Scanning & Enumeration Next Lesson