Now right out of the gate, when we take a look at OpenVos on the website itself
,
we can see on the left side, and I will zoom in for you here for a second,
that we have some tabs that we can open up and expand. One of them is
administration.
So right after you log in, I would highly recommend that you go into this
and go down to Feed Status. The first time that you run OpenVos, there's going
to be an initial
wait period, because as you can see here, we have four default feeds that OpenV
os is referring to
in order to build its database. And this database is going to be the ground
framework for us to be
able to scan for vulnerabilities across the network. We're going to take a look
at these real quick
and kind of get an understanding of what they are. And that is the first one
being the NVT that we
already covered being the default for OpenVos or Greenbone. The next one is Sc
ap. And as you can
see by the logos there, it bases it off of CVE, which in our resources skill,
we learned that this
is a part of CVE.org, where a lot of those vulnerabilities and reported
vulnerabilities
are going to be assigned a CVE and also a CVSS scoring. Then we have a cert,
and I'll dive into
that here momentarily. And then we have our GVMD data, which is the actual
database on the system
itself. And the object feeds from the OpenVos/Greenbone sites that we have that
link up to. So basically,
it's like a pseudo-upped update for the OpenVos environment here on the system
itself. But let's
take a look at what the cert is. But what is the cert bond as we're looking at
the website and see
that there's a little bit of German mixed in? I'm glad you asked. It's an abbre
viation for the
Computer Emergency Response Team for the Federal Administration. That's a lot,
so we're just going
to call it cert. It's owned and operated by the, I'm not even going to try to
pronounce that,
it's in Germany. And you can see the logo for the company that owns it up here,
right there.
And we'll just leave it at that. Now, why is this important? Well, OpenVos/
Greenbone is
affiliated with the European Union, equivalency of what we have here in the US
for CVEs and CISA
and all this other great stuff. They have incident response teams, they have
advisory publishing,
threat analysis and prevention, documentation forms. And if all this sounds
familiar,
it should because that's exactly what we have here when we deal with systems
and organizations
like NIST, CISA and also the CVE categories. So basically, this is where OpenV
os has kind of
an upper end here because as we go back into the actual lab environment you see
here, that
of our resources that we're downloading updates from, NVT, CVEs, cert and also
the GVM database.
Oops, let me go get back in there while that's loading, that we have an
abundance of resources
that allow us the flexibility and adaptability of more than one source like we
usually get with
NIST because it's usually just NISTs that we deal with when we're updating our
definitions.
Variety, if you will. Now I do want to point out that this will take a good bit
. Generally,
it takes about 10 to 15 minutes depending on your internet connection speed to
be able to update
all these definitions first time use because it's a lot of CVEs and a lot of
different things that
we're downloading and updating from with all those multiple sources. Now inside
of our lab
environment, there's one of two ways that you can figure out how this is
actually
going about and how long it's going to take. First one is the easy one as we
zoom in.
Up there at the top you'll see that inside of Cali is a status bar for all of
our processing
and if this is peaking out like you see here, it's probably still downloading
and processing a lot
of information. The other way is is that you could generally go inside of your
terminal if you want
and see what the data rate is currently that you're downloading and get an
understanding of the
nitty-gritty behind it. But generally wait like 10-15 minutes for everything to
update and or
download and update and definitions. Why is this important? Well, earlier in
the course we talked
about online and offline resources and being able to download all of this
information as an
offline tool allows us to be able to build a portable scanner that we could
take different
segments of the network. Can we do this in NSSIS? Absolutely. Can we do this in
both NSSIS and
OpenVOS even better? And you'll notice that a lot of pen testers out there have
scanners that
are built with NSSIS and/or OpenVOS or they have separate systems for them but
they use more than one
for not only the variety but also the verification of a CVE or vulnerability
that has been found on
the system. Trust but verify is always the advantage because if you could find
it on one you should be
able to find it on the other or if you find it on one and the other one doesn't
find it there
may be something wrong with your scanner you can try to update definitions when
you reach back
online capabilities.