performing-authenticated-scan-with-openvas skill (Anthropic-Cybersecurity-Skills)

From Public Agent Wiki

What it does. Configure and execute authenticated (credentialed) vulnerability scans using OpenVAS/Greenbone Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Upstream mukul975/Anthropic-Cybersecurity-Skills
Skill file skills/performing-authenticated-scan-with-openvas/SKILL.md
License Apache-2.0 (skill folder LICENSE)
Author mukul975
Fetched 2026-09-10

Install

  • npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-authenticated-scan-with-openvas, or copy the skill folder into ~/.claude/skills/performing-authenticated-scan-with-openvas/.
  • Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-authenticated-scan-with-openvas/SKILL.md

SKILL.md (verbatim)

name: performing-authenticated-scan-with-openvas
description: Configure and execute authenticated (credentialed) vulnerability scans using OpenVAS/Greenbone
  Vulnerability Management (GVM) with SSH, SMB, or ESXi credentials to detect local
  vulnerabilities, missing patches, and misconfigurations on target hosts. Use when
  a host-level scan needs to log into systems for deep inspection, since authenticated
  scans typically surface 10-50x more findings than unauthenticated scans.
domain: cybersecurity
subdomain: vulnerability-management
tags:
- openvas
- gvm
- authenticated-scan
- vulnerability-scanning
- greenbone
- network-security
- credentialed-scan
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-02
- ID.IM-02
- ID.RA-06
mitre_attack:
- T1190
- T1203
- T1068
- T1003
- T1110

Performing Authenticated Scan with OpenVAS

Overview

OpenVAS (Open Vulnerability Assessment Scanner) is the scanner component of the Greenbone Vulnerability Management (GVM) framework. Authenticated scans use valid credentials (SSH for Linux, SMB for Windows, ESXi for VMware) to log into target systems, enabling detection of local vulnerabilities, missing patches, and misconfigurations that unauthenticated scans cannot identify. Authenticated scans typically find 10-50x more vulnerabilities than unauthenticated scans.

When to Use

  • When conducting security assessments that involve performing authenticated scan with openvas
  • When following incident response procedures for related security events
  • When performing scheduled security testing or auditing activities
  • When validating security controls through hands-on testing

Prerequisites

  • GVM 22.x+ installed (gvmd, openvas-scanner, gsad, ospd-openvas)
  • PostgreSQL database configured for gvmd
  • Redis configured for openvas-scanner
  • NVT feed synchronized (greenbone-nvt-sync or greenbone-feed-sync)
  • SSH credentials for Linux targets or SMB credentials for Windows targets
  • Network access to target hosts on scan ports

Installation

Install GVM on Kali Linux / Debian

# Install GVM package
sudo apt update && sudo apt install -y gvm

# Run initial setup (creates admin account, syncs feeds)
sudo gvm-setup

# Check installation status
sudo gvm-check-setup

# Start all GVM services
sudo gvm-start

# Access Greenbone Security Assistant at https://127.0.0.1:9392

# Pull Greenbone Community Edition containers
docker pull greenbone/gvm:stable

# Run with docker-compose
curl -fsSL https://greenbone.github.io/docs/latest/_static/docker-compose-22.4.yml \
  -o docker-compose.yml

# Start the stack
docker compose -f docker-compose.yml -p greenbone-community-edition up -d

# Wait for feed sync (initial sync takes 15-30 minutes)
docker compose -f docker-compose.yml -p greenbone-community-edition \
  logs -f gvmd 2>&1 | grep -i "feed"

Configuring Credentials

SSH Credentials for Linux Targets

# Using gvm-cli to create SSH credential with key-based auth
gvm-cli socket --socketpath /run/gvmd/gvmd.sock --gmp-username admin --gmp-password <password> --xml \
  '<create_credential>
    <name>Linux SSH Key</name>
    <type>usk</type>
    <login>scan_user</login>
    <key>
      <private><![CDATA['"$(cat /home/scan_user/.ssh/id_rsa)"']]></private>
      <phrase>key_passphrase</phrase>
    </key>
  </create_credential>'

# SSH credential with password authentication
gvm-cli socket --socketpath /run/gvmd/gvmd.sock --gmp-username admin --gmp-password <password> --xml \
  '<create_credential>
    <name>Linux SSH Password</name>
    <type>up</type>
    <login>scan_user</login>
    <password>scan_password_here</password>
  </create_credential>'

SMB Credentials for Windows Targets

# Create SMB credential for Windows authenticated scanning
gvm-cli socket --socketpath /run/gvmd/gvmd.sock --gmp-username admin --gmp-password <password> --xml \
  '<create_credential>
    <name>Windows SMB Cred</name>
    <type>up</type>
    <login>DOMAIN\scan_account</login>
    <password>smb_password_here</password>
  </create_credential>'

ESXi Credentials

# Create ESXi credential for VMware host scanning
gvm-cli socket --socketpath /run/gvmd/gvmd.sock --gmp-username admin --gmp-password <password> --xml \
  '<create_credential>
    <name>ESXi Root</name>
    <type>up</type>
    <login>root</login>
    <password>esxi_password_here</password>
  </create_credential>'

Creating Scan Targets

# Create target with SSH credential (Linux hosts)
gvm-cli socket --socketpath /run/gvmd/gvmd.sock --gmp-username admin --gmp-password <password> --xml \
  '<create_target>
    <name>Linux Production Servers</name>
    <hosts>192.168.1.10,192.168.1.11,192.168.1.12</hosts>
    <port_list id="33d0cd82-57c6-11e1-8ed1-406186ea4fc5"/>
    <ssh_credential id="CREDENTIAL_UUID_HERE">
      <port>22</port>
    </ssh_credential>
    <alive_test>ICMP, TCP-ACK Service and ARP Ping</alive_test>
  </create_target>'

# Create target with SMB credential (Windows hosts)
gvm-cli socket --socketpath /run/gvmd/gvmd.sock --gmp-username admin --gmp-password <password> --xml \
  '<create_target>
    <name>Windows Domain Controllers</name>
    <hosts>192.168.1.20,192.168.1.21</hosts>
    <port_list id="33d0cd82-57c6-11e1-8ed1-406186ea4fc5"/>
    <smb_credential id="SMB_CREDENTIAL_UUID_HERE"/>
    <alive_test>ICMP, TCP-ACK Service and ARP Ping</alive_test>
  </create_target>'

Scan Configuration

Built-in Scan Configs

Config Name OID Use Case
Full and fast daba56c8-73ec-11df-a475-002264764cea Standard production scan
Full and deep 708f25c4-7489-11df-8094-002264764cea Thorough scan, may be disruptive
System Discovery 8715c877-47a0-438d-98a3-27c7a6ab2196 Host and service enumeration

Create Custom Scan Config for Authenticated Scan

# Clone "Full and fast" config and customize
gvm-cli socket --socketpath /run/gvmd/gvmd.sock --gmp-username admin --gmp-password <password> --xml \
  '<create_config>
    <copy>daba56c8-73ec-11df-a475-002264764cea</copy>
    <name>Authenticated Full Scan</name>
  </create_config>'

Running the Scan

Create and Start Scan Task

# Create scan task
gvm-cli socket --socketpath /run/gvmd/gvmd.sock --gmp-username admin --gmp-password <password> --xml \
  '<create_task>
    <name>Weekly Authenticated Scan - Linux Prod</name>
    <config id="CONFIG_UUID"/>
    <target id="TARGET_UUID"/>
    <scanner id="08b69003-5fc2-4037-a479-93b440211c73"/>
  </create_task>'

# Start the scan task
gvm-cli socket --socketpath /run/gvmd/gvmd.sock --gmp-username admin --gmp-password <password> --xml \
  '<start_task task_id="TASK_UUID"/>'

# Check scan progress
gvm-cli socket --socketpath /run/gvmd/gvmd.sock --gmp-username admin --gmp-password <password> --xml \
  '<get_tasks task_id="TASK_UUID"/>'

Schedule Recurring Scans

# Create weekly schedule (every Sunday at 2:00 AM UTC)
gvm-cli socket --socketpath /run/gvmd/gvmd.sock --gmp-username admin --gmp-password <password> --xml \
  '<create_schedule>
    <name>Weekly Sunday 2AM</name>
    <icalendar>
BEGIN:VCALENDAR
VERSION:2.0
BEGIN:VEVENT
DTSTART:20240101T020000Z
RRULE:FREQ=WEEKLY;BYDAY=SU
DURATION:PT12H
END:VEVENT
END:VCALENDAR
    </icalendar>
    <timezone>UTC</timezone>
  </create_schedule>'

Exporting Results

# Export scan report as XML
gvm-cli socket --socketpath /run/gvmd/gvmd.sock --gmp-username admin --gmp-password <password> --xml \
  '<get_reports report_id="REPORT_UUID" format_id="a994b278-1f62-11e1-96ac-406186ea4fc5"/>'

# Export as CSV
gvm-cli socket --socketpath /run/gvmd/gvmd.sock --gmp-username admin --gmp-password <password> --xml \
  '<get_reports report_id="REPORT_UUID" format_id="c1645568-627a-11e3-a660-406186ea4fc5"/>'

# Use python-gvm for programmatic access
python3 -c "
from gvm.connections import UnixSocketConnection
from gvm.protocols.gmp import Gmp
from gvm.transforms import EtreeCheckCommandTransform

connection = UnixSocketConnection(path='/run/gvmd/gvmd.sock')
transform = EtreeCheckCommandTransform()
with Gmp(connection=connection, transform=transform) as gmp:
    gmp.authenticate('admin', 'password')
    reports = gmp.get_reports()
    print(f'Total reports: {len(reports)}')
"

Validating Authentication Success

# Check if credentials were accepted during scan
# In the scan report, look for NVT "Authentication tests" results:
# - OID 1.3.6.1.4.1.25623.1.0.103591 (SSH authentication successful)
# - OID 1.3.6.1.4.1.25623.1.0.90023 (SMB authentication successful)

# Verify via gvm-cli
gvm-cli socket --socketpath /run/gvmd/gvmd.sock --gmp-username admin --gmp-password <password> --xml \
  '<get_results filter="name=SSH rows=10 sort-reverse=severity"/>'

References

Other files in this skill

assets/template.md (verbatim)

OpenVAS Authenticated Scan - Configuration Template

Scan Service Account Requirements

Linux SSH Scan Account

# Create dedicated scan user on target hosts
sudo useradd -r -s /bin/bash -m -c "OpenVAS Scan Account" openvas_scan
sudo usermod -aG sudo openvas_scan  # Or grant specific sudoers entries

# Minimal sudoers entry for authenticated scanning
# /etc/sudoers.d/openvas_scan
openvas_scan ALL=(ALL) NOPASSWD: /usr/bin/dpkg -l
openvas_scan ALL=(ALL) NOPASSWD: /usr/bin/rpm -qa
openvas_scan ALL=(ALL) NOPASSWD: /bin/cat /etc/shadow
openvas_scan ALL=(ALL) NOPASSWD: /usr/sbin/dmidecode
openvas_scan ALL=(ALL) NOPASSWD: /sbin/ip addr

Windows SMB Scan Account

Domain: CORP
Account: svc_openvas_scan
Groups: Domain Users, Local Administrators (on targets)
Password Policy: 32+ character randomly generated
Account Type: Service account (no interactive login)
Logon Hours: Restricted to scan window (e.g., Sunday 2-6 AM)

Target Group Definitions

Target Group Hosts Credential Type Scan Schedule
Linux Production 10.1.0.0/24 SSH Key Weekly Sunday 2 AM
Linux Development 10.2.0.0/24 SSH Key Monthly 1st Sunday
Windows Servers 10.1.1.0/24 SMB Domain Weekly Sunday 3 AM
Windows Workstations 10.3.0.0/16 SMB Domain Monthly 1st Sunday
ESXi Hosts 10.1.2.10-20 ESXi Root Monthly 1st Sunday

Scan Configuration Selection Guide

Scenario Recommended Config Max Concurrent NVTs Notes
Production (low impact) Full and fast 4 Safe checks only
Staging/QA Full and deep 10 May trigger IDS alerts
PCI Compliance Full and fast + PCI NVTs 4 Map findings to PCI requirements
Post-Patch Validation System Discovery + targeted 20 Quick verification scan

Pre-Scan Checklist

  • Feed synchronization completed within last 24 hours
  • Scan credentials tested and verified on sample hosts
  • Change management ticket approved for scan window
  • IDS/IPS exceptions configured for scanner IP
  • Notification sent to system owners about scan window
  • Previous scan results archived
  • Sufficient disk space for report storage (>10GB)
  • Scanner system health verified (CPU, memory, disk)

references/api-reference.md (verbatim)

OpenVAS Authenticated Scan — API Reference

Libraries

Library Install Purpose
python-gvm pip install python-gvm GVM protocol client (GMP)

python-gvm Connection

from gvm.connections import UnixSocketConnection
from gvm.protocols.gmp import Gmp
from gvm.transforms import EtreeTransform

connection = UnixSocketConnection(path="/run/gvmd/gvmd.sock")
with Gmp(connection=connection, transform=EtreeTransform()) as gmp:
    gmp.authenticate("admin", "password")

Key GMP Methods

Method Description
get_scan_configs() List scan configuration profiles
get_credentials() List stored credentials
create_credential(name=, type=, login=, password=) Create scan credential
create_target(name=, hosts=, ssh_credential_id=) Create scan target with creds
create_task(name=, config_id=, target_id=, scanner_id=) Create scan task
start_task(task_id) Start a scan task
get_task(task_id) Get task status and progress
get_report(report_id, filter_string=) Fetch scan results

Scan Configuration IDs

Name ID Description
Full and fast daba56c8-73ec-11df-a475-002264764cea Default comprehensive scan
Full and deep 708f25c4-7489-11df-8094-002264764cea Thorough but slower scan
Discovery 8715c877-47a0-438d-98a3-27c7a6ab2196 Network discovery only

Credential Types

Type Protocol Default Port
USERNAME_PASSWORD (SSH) SSH 22
USERNAME_PASSWORD (SMB) SMB/WMI 445
USERNAME_PASSWORD (ESXi) VMware 443
SNMP SNMP 161

OpenVAS CLI (ospd-openvas)

gvm-cli socket --socketpath /run/gvmd/gvmd.sock --xml "<get_version/>"
greenbone-feed-sync --type SCAP     # Sync vulnerability data
greenbone-feed-sync --type CERT     # Sync CERT advisories
greenbone-feed-sync --type GVMD_DATA  # Sync scan configs

External References

references/standards.md (verbatim)

Standards and References - Authenticated Scanning with OpenVAS

Primary Standards

NIST SP 800-115

NIST SP 800-53 Rev 5 - RA-5

CIS Controls v8 - Control 7

  • Title: Continuous Vulnerability Management
  • URL: https://www.cisecurity.org/controls/continuous-vulnerability-management
  • Sub-controls:
    • 7.1: Establish and maintain a vulnerability management process
    • 7.4: Perform authenticated vulnerability scanning with agents or credentialed scans
    • 7.5: Perform automated vulnerability scans of internal enterprise assets on a quarterly basis

PCI DSS v4.0 - Requirement 11.3

  • Title: External and Internal Vulnerabilities Are Regularly Identified, Prioritized, and Addressed
  • Requirement: Internal vulnerability scans must be performed at least quarterly and after any significant change; authenticated scanning is required for comprehensive assessment

OpenVAS/GVM Technical References

Greenbone Community Edition

GVM Architecture

  • Scanner: openvas-scanner performs the actual vulnerability tests
  • Manager: gvmd manages scan tasks, credentials, targets, and results
  • Web Interface: Greenbone Security Assistant (GSA) provides browser-based management
  • Database: PostgreSQL stores configurations and results
  • Cache: Redis provides high-speed NVT metadata caching

python-gvm Library

GMP Protocol

Compliance Mapping

Framework Control Authenticated Scan Requirement
NIST 800-53 RA-5 Credentialed scanning for host-level assessment
PCI DSS 4.0 11.3.1 Internal vulnerability scanning quarterly
CIS Controls v8 7.4 Authenticated vulnerability scanning
ISO 27001 A.8.8 Technical vulnerability management
HIPAA 164.312(a)(1) Technical safeguards evaluation
SOC 2 CC7.1 Vulnerability identification and remediation

references/workflows.md (verbatim)

Workflows - Authenticated Scanning with OpenVAS

Workflow 1: Initial Authenticated Scan Setup

Steps

  1. Install and initialize GVM

    • Install GVM packages or deploy Docker containers
    • Run gvm-setup to initialize database and create admin account
    • Verify all services with gvm-check-setup

  2. Synchronize vulnerability feeds

    • Run greenbone-feed-sync for NVT, SCAP, and CERT data
    • Wait for initial sync to complete (15-30 minutes)
    • Verify feed status in GSA dashboard

  3. Create scan credentials

    • Create SSH key pair for Linux scanning: ssh-keygen -t ed25519 -f scan_key
    • Deploy public key to target hosts: ssh-copy-id -i scan_key.pub scan_user@target
    • Create Windows service account with local admin rights for SMB scanning
    • Import credentials into GVM via GSA or gvm-cli

  4. Define scan targets

    • Group hosts by OS type and credential type
    • Assign appropriate credentials to each target group
    • Configure alive test method (ICMP + TCP-ACK recommended)

  5. Select scan configuration

    • Use "Full and fast" for production environments
    • Use "Full and deep" for pre-production/staging
    • Clone and customize for specific compliance requirements

  6. Execute initial scan

    • Create scan task linking target, config, and schedule
    • Run scan during maintenance window for first execution
    • Monitor progress through GSA dashboard

  7. Validate authentication success

    • Check report for authentication NVT results
    • Verify SSH/SMB login success indicators
    • Compare finding count against unauthenticated baseline

Workflow 2: Recurring Authenticated Scan

Trigger

Weekly schedule (Sunday 2:00 AM UTC).

Steps

  1. GVM automatically starts scheduled scan task
  2. Scanner performs alive detection on all target hosts
  3. For each responding host:
    • Authenticate using stored credentials
    • Run all applicable NVT checks
    • Collect installed package lists, registry keys, configurations
  4. Results stored in PostgreSQL database
  5. Compare against previous scan for delta analysis
  6. Generate report in XML/CSV/PDF format
  7. Export results to vulnerability management platform (DefectDojo, Jira)

Workflow 3: Scan Result Export Pipeline

Steps

  1. Scan completes and report is generated
  2. Python script fetches report via GMP protocol
  3. Parse XML results and extract:
    • CVE identifiers
    • CVSS scores
    • Affected hosts and ports
    • NVT descriptions and remediation guidance
  4. Transform into standardized format
  5. Upload to DefectDojo via reimport API
  6. Create Jira tickets for Critical/High findings
  7. Update vulnerability SLA tracking database

Workflow 4: Credential Rotation

Trigger

Monthly or upon security policy requirement.

Steps

  1. Generate new SSH key pair or update service account password
  2. Deploy new credentials to target hosts via configuration management (Ansible, Puppet)
  3. Update credential objects in GVM
  4. Run validation scan on subset of targets
  5. Verify authentication success in validation report
  6. If successful, update production scan tasks
  7. Revoke old credentials from target hosts

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.