Purpose
Use this skill for broad vulnerability scanning when the engagement needs baseline coverage of approved assets using an OpenVAS or Greenbone-style workflow.
Phase Fit
- Primary: Vulnerability Analysis
- Secondary: Discovery and Reconnaissance, Retest and Closure
Use When
- Need scanner-led breadth coverage across approved hosts or services.
- Need a repeatable open-source scanning workflow.
- Need a retest baseline after remediation.
Avoid When
- Scanner scope or performance constraints are unclear.
- Findings would be reported without analyst validation.
Inputs
- Approved target list and scan windows
- Credential mode, plugin scope, and exclusions
- Output and evidence requirements
Procedure
- Scope the scan to the smallest approved asset set that fits the objective.
- Tune scan configuration to the current phase objective.
- Triage results for material, reachable issues.
- Manually validate important findings before escalation.
- Preserve the same scan configuration for retest.
Command Syntax
Launch and management syntax varies by distribution. On Greenbone-based installs, the most stable command-line examples are the service wrapper and a small gvm-cli GMP request.
# Start GVM services
gvm-start
# Stop GVM services
gvm-stop
# Check setup and prerequisites
gvm-check-setup
# Send a GMP XML request (get version)
gvm-cli socket --xml "<get_version/>"
# List existing tasks
gvm-cli socket --xml "<get_tasks/>"
# List targets
gvm-cli socket --xml "<get_targets/>"
# Start a task by ID
gvm-cli socket --xml "<start_task task_id='<task-id>'/>"
Evidence to Capture
- Material scanner findings tied to approved assets
- Exact configuration, credential mode, and target scope used
- Which findings were manually validated versus triage-only
Safety Boundaries
- Keep scans within approved targets, windows, and plugin scope.
- Treat raw scanner output as triage input until validated.