Vulnerability Assessment with Nmap, OpenVAS, and Nikto

IntermediateSecurity~5 hours
NmapOpenVASNiktoCVSS 3.1

I ran a layered vulnerability assessment combining Nmap service discovery, OpenVAS authenticated scanning, and Nikto web checks, then triaged findings by CVSS 3.1 base score. The workflow converted a raw scan dump of 200+ findings into a business-ranked remediation queue.

Objective & Context

Scanning without prioritization just produces noise. This lab pairs broad discovery with credentialed depth and a scoring rubric, implementing CIS Control 7 (Continuous Vulnerability Management) and feeding the NIST SP 800-40 patch lifecycle.

  • T1595.002 Vulnerability Scanning – the same technique adversaries use, run defensively.
  • T1190 Exploit Public-Facing Application – prioritizes internet-reachable critical CVEs first.

Environment & Prerequisites

  • Kali/BackBox scanner; OpenVAS/GVM 22.4 with synced feeds.
  • Authorized target subnet and credentialed scan accounts.
  • Nmap 7.94 with NSE vuln category; Nikto 2.5.

Step-by-Step Execution

1. Discover services and run NSE vuln scripts

nmap -sV --script vuln -oA vuln-scan 192.168.20.0/24

2. Launch a credentialed OpenVAS scan

gvm-cli --gmp-username admin socket --xml "<start_task task_id='UUID'/>"

3. Web-app checks with Nikto

nikto -h https://192.168.20.30 -Format csv -o nikto.csv
+ Server: nginx/1.18.0
+ OSVDB-3092: /admin/: This might be interesting...
+ /server-status: Apache server-status found

Validation & Testing

Cross-validate the top OpenVAS findings against Nmap NSE output to eliminate false positives, then confirm each critical maps to a real CVE with a CVSS base ≥ 9.0. Pass criteria: a deduplicated, evidence-backed finding list ordered by score and exposure.

Advanced: Troubleshooting
  • Few results: uncredentialed scans miss local CVEs; supply SSH/SMB credentials.
  • Stale feed: run greenbone-feed-sync and check /var/log/gvm/.
  • False positives: corroborate with banner grabs and version checks before reporting.

Key Results

  • Triaged 200+ raw findings into a CVSS-ranked queue with 4 criticals surfaced first.
  • Reduced false positives by roughly 60% through cross-tool corroboration.
  • Mapped every critical finding to a specific CVE and affected version.
  • Cut time-to-first-remediation-ticket from days to under 1 hour.

Related Labs