Open Vulnerability Assessment System (or OpenVAS for short) is a full-featured, cross-functional, open-source web security scanner (opens in new tab) that started its existence when Nessus ceased to be an open-source software and was changed into a commercial security solution.
Once named GNessUs and set in motion as a spin-off of Nessus, it still uses plenty of plugins written in Nessus Attack Scripting Language (NASL). Ultimately, in 2006, OpenVAS would come to be the enterprise-level tool we know today.
Nowadays, OpenVAS comes in two forms: as an open-source module and as a component of commercial software, both of which are maintained by Germany-based Greenbone Networks.
OpenVAS’s official site is so simplistic it’ll redirect you to Greenbone’s site and their GitHub pages right off the bat, so you can find out something about OpenVAS and its history.
However, to be fair, their GitHub page offers plenty of information – perhaps even more than you’ll care to read. Plus, there’s a blog and it appears to be pretty much alive.
Both Greenbone’s and OpenVAS’s sites are available in English and German language.
In addition to GitHub, you can find Greenbone on LinkedIn.
Plans and pricing
OpenVAS will allow you to stay one step ahead of cybercriminals and it will let you do so without spending a single penny – it’s a free-to-use, open-source solution after all.
However, if you want a bit beyond what this freeware has to offer, you can purchase one of Greenbone’s paid products: Greenbone Enterprise Appliances or Greenbone Cloud Service. While both products are described in great detail, to get their pricing you’ll have to request a quote via ticket form where you’ll be asked to give details about yourself, your business, and its security requirements.
Also, you can request a 14-day free trial to test Greenbone’s paid products for yourself.
While OpenVAS was created with Linux (opens in new tab) in mind, it can readily run on Windows if you create a Linux virtual machine on it – however, this will require some technical skills.
Features and functionality
OpenVAS is a vulnerability scanner, which means its mission is to proactively search for security weaknesses in your systems and software running on them, identify them, and predict how strong your cybersecurity measures are in case of an attack. It’s one of the most critical tools in any cybersecurity toolbox.
Its core capabilities include unauthenticated and authenticated testing, a whole variety of high-level and low-level internet and industrial protocols, performance tuning, and an internal programming language for implementing various vulnerability tests.
OpenVAS comes in two feeds, Greenbone Community Feed (a cost-free and an open-source one) and Greenbone Enterprise Feed (a commercial one).
While the open-source feed is slightly short on features, it still has fairly comprehensive coverage that includes home apps (for instance, those for Ubuntu, AVM Fritzbox, and MS Office).
It also comes with general and custom scan configurations, report formats, port lists, and critical vulnerability tests. However, since Greenbone has a creative and contributing community scattered across the world, its community feed currently contains over 100,000 vulnerability tests.
We should also note that all data is updated on a day-to-day basis but without any warranties.
Interface and ease of use
Downloading and installing OpenVAS is fairly complex and will certainly overwhelm non-tech-savvy users – that’s why many will call it a quit there and start seeking alternatives.
In short, if you’re a Linux enthusiast familiar with building software from source code you won’t have an issue with this, since to install OpenVAS you’ll have to build it from source code. If not, perhaps you should consider other options out there.
Alternatively, you can use an OpenVAS virtual machine for which you’ll require a virtual machine player – so, consider using VirtualBox – is free, open-source, and available on all operating systems (OS’).
While the virtual machine option is much simpler than the source code one, it’s still a far cry from being beginner-friendly in any way.
If everything turns out all right, you’ll proceed to the OpenVAS user interface (UI) which looks overly outdated but isn’t counter-intuitive. It also includes a wizard that’ll help you to set up both simple and advanced scans for target machines – so, go find a magic staff symbol in the upper-left corner, click on it, select “Task Wizard” (or “Advanced Task Wizard” for advanced scans), insert an IP address you want to scan and tap into “Start Scan” button.
Our scan was completed surprisingly swiftly and even after we switched several scan policies the time it took was perfectly reasonable.
Customer support
OpenVAS isn’t precisely strong in terms of customer support, so if you get stuck along the way (and yes, you probably will), you’ll have to settle for self-support options. Unfortunately, even if you’re willing to pay a pretty penny for premium support, there simply isn’t an option to get one.
Meanwhile, you’re welcome to get in touch with Greenbone’s team via e-mail or submit a support ticket if you’ve created an account with them. However, to get the technical support you’ll have to check out if anyone on Greenbone’s community forum is willing to lend you a hand out of the goodness of their heart.
In addition to the documentation page on Greenbone’s site, you can also find a FAQ section, a glossary, and a changelog.
Competition
Besides being an inspiration to OpenVAS, Nessus is also its most powerful competitor. In terms of performance, Nessus wins by a whisker – it covers a wider array of vulnerabilities and provides a lower false-positive rate. On the other hand, OpenVAS is more pocket-friendly and offers a free module as well – so, if you have a tight budget to think about, give OpenVAS a go.
While Vulnerability Manager Plus beats OpenVAS when it comes to being beginner-friendly, simple-to-use overall, and having a modern-looking UI, OpenVAS is much more than a simple vulnerability scanner so it wins in terms of complexity, customization, and scan coverage.
If you’re looking for something more user-friendly and much simpler than OpenVAS, Probely will probably do the trick. However, its free plan is as basic as they get.
Final verdict
OpenVAS is a powerful, all-in-one vulnerability scanner able to perform large-scale assessments and a whole variety of network vulnerability tests. Its major selling points include its colorful developer community, comprehensive scan coverage, and the fact it is cost-free open-source software.
On the downside, it’s geared toward tech-savvy, do-it-yourself types of users.
