Now I had promised that we would look at alternatives to Nessus because as we
know and went through
the skills for Nessus that it is a costly adventure sometimes depending on how
big of a scope you're
wanting to use Nessus for and the trial license doesn't really last that long.
And one of the
things that we can definitely use to be able to help us do vulnerability scans
at more affordable
rates is OpenVos. Now OpenVos meaning Open Vulnerability Assessment System is
generally free to use
depending on which version of it that you're wanting to use. We'll be using the
community
standard throughout this skill as it's based on open source vulnerability
scanning and uses some
of the same things that Nessus uses in order to build its vulnerability
database for assessment.
Now if you remember when we were going over Nessus that definitions were built
based on CVEs,
common vulnerability and exposures. Now in the OpenVos world we use NVTs and I
don't remember
what this is so I'm going to take a look at it real quick. Network V
ulnerability Test which is a very
fancy way of saying that the scanning utilized in OpenVos it mimics in the same
nature that Nessus
does, how it does its vulnerability assessment and scanning. Now we're going to
see a lot of
similarities between Nessus and OpenVos as we begin to go through and do the
installation process
and get a basic idea of how it works in a pen testing atmosphere. And it's
going to be done inside
of our same lab that we've been using thus far so this shouldn't be too big of
a difference for us
better yet it even works with Cali and inside one of the listings inside of
tools that Cali uses.
So you can do a pseudo app install to be able to utilize OpenVos and configure
it open on your
system for vulnerability assessments. Now I have here pulled up the OpenVos.org
website to which
I will have a link below for you to follow but right off the bat one of the
biggest differences
that we have between Nessus and OpenVos is that OpenVos is not native to
Windows and while you can get
it to work inside of a Windows environment it requires a lot of elbow to hand
phonetically.
So you would have to set up the Windows system for Linux inside a PowerShell,
Hyper-V and all
this other great stuff. Long story short you would basically have to set up a
virtual environment
be it from Hyper-V or virtual machine in order to get OpenVos to work inside of
Windows
but you're still in that Linux environment. So just keep that in mind as you
can get this to run
on really any POSIX-based system just it's not native to Windows. Now I also
have pulled up here
on the actual screen right now the site so that way you can look and see that
there's a lot of
information to be able to pull from here. Some of this most of this for the
installation will be
covering throughout the rest of the skill. I just want you to know that this is
definitely one of
the resources that you should definitely check out in case you want to expand
the scope of what you
learned here inside of this skill or if you want to go through and see if there
's anything inside
the community form because the community for OpenVos is very active and does
report things like CVEs,
zero days and other vulnerabilities that we may know little about but can
expand our knowledge on
and have a starting point of research.