OpenVAS：Kali Linux 中的漏洞评估工具
Kali OpenVAS 漏洞评估
本教程将介绍在 Kali Linux 中安装 OpenVAS 8.0 的过程。 OpenVAS 是一个可以自动执行网络安全审核和漏洞评估的开源[漏洞评估](https://www.aptive.co.uk/vulnerability-assessment/)程序。请注意，<ruby> 漏洞评估 <rp>  （ </rp> <rt>  Vulnerability Assessment </rt> <rp>  ） </rp></ruby>也称为 VA 并不是<ruby> 渗透测试 <rp>  （ </rp> <rt>  penetration test </rt> <rp>  ） </rp></ruby>，渗透测试会进一步验证是否存在发现的漏洞，请参阅[什么是渗透测试](https://www.aptive.co.uk/penetration-testing/)来对渗透测试的构成以及不同类型的安全测试有一个了解。


![](/data/attachment/album/201704/23/190118ok22ixxd81x81y0b.jpg)


### 什么是 Kali Linux?


Kali Linux 是 Linux 渗透测试分发版。它基于 Debian，并且预安装了许多常用的渗透测试工具，例如 Metasploit Framework （MSF）和其他通常在安全评估期间由渗透测试人员使用的命令行工具。


在大多数使用情况下，Kali 运行在虚拟机中，你可以在这里获取最新的 VMWare 或 Vbox 镜像：<https://www.offensive-security.com/kali-linux-vmware-virtualbox-image-download/> 。


除非你有特殊的原因想要一个更小的虚拟机占用空间，否则请下载完整版本而不是 Kali light。 下载完成后，你需要解压文件并打开 vbox 或者 VMWare .vmx 文件，虚拟机启动后，默认帐号是 `root`/`toor`。请将 root 密码更改为安全的密码。


或者，你可以下载 ISO 版本，并在裸机上执行 Kali 的安装。


### 升级 Kali Linux


完成安装后，为 Kail Linux 执行一次完整的升级。


升级 Kali：



```
apt-get update && apt-get dist-upgrade -y

```

![Updating Kali Linux](/data/attachment/album/201704/23/190207mnb2ypo7yx2bww7y.png)


更新过程可能需要一些时间才能完成。Kali 目前是滚动更新，这意味着你可以从任何版本的 Kali 滚动更新到当前版本。然而它仍有发布号，但这些是针对特定 Kali 时间点版本的 VMWare 快照。你可以从任何 VMWare 镜像更新到当前的稳定版本。


更新完成后重新启动。


### 安装 OpenVAS 8


![Installing OpenVAS 8](/data/attachment/album/201704/23/190209dazzlhkk6xh5t9ui.png)



```
apt-get install openvas

openvas-setup

```

在安装中，你会被询问关于 redis 的问题，选择默认选项来以 UNIX 套接字运行。


![Configure OpenVAS Scanner](/data/attachment/album/201704/23/190212kd711kucgvod75ok.png)


即使是有快速的网络连接，openvas-setup 仍需要很长时间来下载和更新所有所需的 CVE、SCAP 定义。


![Update all the required CVE, SCAP definitions](/data/attachment/album/201704/23/190219cvpqtltfpjkmqixv.png)


请注意 openvas-setup 的命令输出，密码会在安装过程中生成，并在安装的最后在控制台中打印出来。


![Command output during install](/data/attachment/album/201704/23/190225qe3iqwk0bmaqmmgv.png)


验证 openvas 正在运行:



```
netstat -tulpn

```

![Check OpenVAS Status](/data/attachment/album/201704/23/190228a9xjdcdttr6aw55j.png)


### 在 Kali 中运行 OpenVAS


要在 Kali 中启动 OpenVAS：



```
openvas-start

```

安装后，你应该可以通过 `https://127.0.0.1:9392` 访问 OpenVAS 的 web 程序了。


![OpenVAS started](/data/attachment/album/201704/23/190229zxh0nhhbn1vvnv31.png)


接受自签名证书，并使用 openvas-setup 输出的 admin 凭证和密码登录程序。


![Accept the self-signed SSL cert](/data/attachment/album/201704/23/190232fgokek2ggg95e0vk.png)


接受自签名证书后，你应该可以看到登录界面了。


![OpenVAS Login](/data/attachment/album/201704/23/190235vm3rjmxf6vi131ez.png)


登录后，你应该可以看到下面的页面：


![OpenVAS Dashboard](/data/attachment/album/201704/23/190237jb28dinhsnh0e8t8.png)


从此，你应该可以使用向导配置自己的漏洞扫描了。


我建议阅读文档。请注意漏洞评估导向（取决于 OpenVAS 可能尝试利用的配置）及其在网络上生成的流量以及网络上可能对服务/服务器和主机/设备产生的 DOS 影响。


（题图：[pixabay.com](http://www.pixabay.com/), CC0）




---


via: <https://www.howtoforge.com/tutorial/openvas-vulnerability-assessment-install-on-kali-linux/>


作者：[KJS](https://www.howtoforge.com/tutorial/openvas-vulnerability-assessment-install-on-kali-linux/) 译者：[geekpi](https://github.com/geekpi) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
# OpenVAS - Vulnerability Assessment install on Kali Linux

This tutorial documents the process of installing OpenVAS 8.0 on Kali Linux rolling. OpenVAS is open source [vulnerability assessment](https://www.aptive.co.uk/vulnerability-assessment/) application that automates the process of performing network security audits and vulnerability assessments. Note, a vulnerability assessment also known as VA is not a penetration test, a penetration test goes a step further and validates the existence of a discovered vulnerability, see [what is penetration testing](https://www.aptive.co.uk/penetration-testing/) for an overview of what pen testing consists of and the different types of security testing.

## What is Kali Linux?

Kali Linux is a Linux penetration testing distribution. It's Debian based and comes pre-installed with many commonly used penetration testing tools such as Metasploit Framework and other command line tools typically used by penetration testers during a security assessment.

For most use cases Kali runs in a VM, you can grab the latest VMWare or Vbox image of Kali from here: [https://www.offensive-security.com/kali-linux-vmware-virtualbox-image-download/](https://www.offensive-security.com/kali-linux-vmware-virtualbox-image-download/)

Download the full version not Kali light, unless you have a specific reason for wanting a smaller virtual machine footprint. After the download finishes you will need to extract the contents and open the vbox or VMWare .vmx file, when the machine boots the default credentials are root / toor. Change the root password to a secure password.

Alternatively, you can download the ISO version and perform an installation of Kali on the bare metal.

## Updating Kali Linux

After installation, perform a full update of Kali Linux.

Updating Kali:

apt-get update && apt-get dist-upgrade -y

The update process might take some time to complete. Kali is now a rolling release meaning you can update to the current version from any version of Kali rolling. However, there are release numbers but these are point in time versions of Kali rolling for VMWare snapshots. You can update to the current stable release from any of the VMWare images.

After updating perform a reboot.

## Installing OpenVAS 8

apt-get install openvas

openvas-setup

During installation you'll be prompted about redis, select the default option to run as a UNIX socket.

Even on a fast connection openvas-setup takes a long time to download and update all the required CVE, SCAP definitions.

Pay attention to the command output during openvas-setup, the password is generated during installation and printed to console near the end of the setup.

Verify openvas is running:

netstat -tulpn

## Start OpenVAS on Kali

To start the OpenVAS service on Kali run:

openvas-start

After installation, you should be able to access the OpenVAS web application at **https://127.0.0.1:9392**

Accept the self-signed certificate and login to the application using the credentials admin and the password displayed during openvas-setup.

After accepting the self-signed certificate, you should be presented with the login screen:

After logging in you should be presented with the following screen:

From this point you should be able to configure your own vulnerability scans using the wizard.

It's recommended to read the documentation. Be aware of what a vulnerability assessment conductions (depending on configuration OpenVAS could attempt exploitation) and the traffic it will generate on a network as well as the DOS effect it can have on services / servers and hosts / devices on a network.