Operation SecureScan — OpenVAS Vulnerability Assessment & Incident Response

Project Overview

This project demonstrates a complete Vulnerability Assessment and Incident Response workflow using OpenVAS (Greenbone Vulnerability Manager) in a controlled cybersecurity lab environment.

The assessment targeted Metasploitable2 and identified a Critical Vulnerability — vsftpd Compromised Source Packages Backdoor (CVE-2011-2523).

The project simulates real-world SOC Analyst, Security Analyst, and Vulnerability Management responsibilities including:

• Vulnerability Discovery
• Risk Assessment
• Critical Vulnerability Analysis
• Incident Containment
• Remediation Planning
• Security Reporting

Objectives

✔ Configure OpenVAS Vulnerability Scanner

✔ Perform Vulnerability Assessment

✔ Analyze Critical Security Findings

✔ Investigate CVE-2011-2523

✔ Assess Risk & Security Impact

✔ Develop Remediation Strategy

✔ Produce Incident Response Documentation

Lab Environment

Architecture Diagram

Host Machine
│
├── Kali Linux
│      └── OpenVAS Scanner
│
└── Metasploitable2
       └── Vulnerable Target

Technologies Used

• Kali Linux
• OpenVAS / Greenbone
• Metasploitable2
• Linux Networking
• CVE Analysis
• MITRE ATT&CK
• Incident Response
• Vulnerability Management

Methodology

Step 1 — Identify Metasploitable2 IP Address

Identify the target IP address.

Screenshot

Step 2 — Verify Network Connectivity

Validate connectivity between Kali Linux and the vulnerable target.

Screenshot

Step 3 — Add Target in OpenVAS

Navigate:

Configuration → Targets

Create target using the Metasploitable2 IP address.

Screenshot

Step 4 — Launch Vulnerability Scan

Navigate:

Scans → Tasks

Create and launch a vulnerability scan.

Configuration used:

Full and Fast

Screenshot

Step 5 — Monitor Scan Progress

Track:

• Scan Progress
• Severity Results
• Running Status

Screenshot

Step 6 — Analyze Scan Report

Review vulnerability findings and identified security issues.

Navigate:

Scans → Reports

Screenshot

Vulnerability Assessment Findings

Results Severity Analysis

Review severity distribution identified during scanning.

Screenshot

Ports Severity Analysis

Analyze vulnerable network services and exposed ports.

Screenshot

Applications Severity Analysis

Review vulnerable applications detected by OpenVAS.

Screenshot

CVE Severity Analysis

Review discovered CVEs and severity scoring.

Screenshot

Critical Vulnerability Investigation

vsftpd Compromised Source Packages Backdoor

Vulnerability Details

Technical Description

The vulnerability affects a maliciously modified version of the Very Secure FTP Daemon (vsftpd).

The compromised source package introduces hidden backdoor functionality inside the FTP service.

When triggered, the service creates an unauthorized shell listener on TCP Port 6200, allowing attackers to gain:

• Remote Shell Access
• Unauthorized Command Execution
• Service Compromise
• Potential Persistence

Attack Flow

Reconnaissance
      ↓
FTP Enumeration
      ↓
Backdoor Trigger
      ↓
TCP/6200 Listener Activation
      ↓
Remote Command Execution
      ↓
System Compromise

Security Impact

Successful exploitation may result in:

• Remote Code Execution
• Unauthorized Access
• Privilege Abuse
• Malware Deployment
• Lateral Movement
• Persistence Establishment

Vulnerability Evidence

Screenshot

MITRE ATT&CK Mapping

Incident Response Workflow

The project follows a NIST-style Incident Response lifecycle.

Identification

OpenVAS identified a Critical FTP Service Vulnerability affecting the target host.

Containment

Recommended actions:

• Disable vulnerable FTP service
• Isolate affected system
• Restrict affected ports
• Preserve evidence

Eradication

Recommended remediation actions:

• Remove compromised package
• Install trusted software release
• Apply patches
• Validate package integrity

Recovery

Perform:

• Service Validation
• Post-Remediation Scanning
• Security Monitoring

Lessons Learned

Implement:

• Continuous Vulnerability Management
• Patch Governance
• Network Segmentation
• Security Hardening

Remediation Recommendations

Immediate Actions

✔ Disable vulnerable FTP service

✔ Restrict ports 21/TCP and 6200/TCP

✔ Review system and authentication logs

✔ Validate package integrity

✔ Re-scan after remediation

Long-Term Security Improvements

• Continuous Monitoring
• Patch Management Lifecycle
• Threat Detection
• Asset Inventory Management
• Incident Response Readiness

Wrap-Up & Cleanup

Final validation and project cleanup activities.

Screenshot

Skills Demonstrated

• Vulnerability Assessment
• OpenVAS Administration
• Security Operations
• CVE Analysis
• Incident Response
• Risk Assessment
• Threat Analysis
• MITRE ATT&CK
• Security Documentation

Documentation

Additional supporting documentation:

• CVE Research
• Remediation Plan

References

• OpenVAS Documentation
• MITRE ATT&CK Framework
• NIST SP 800-61 Incident Response Guide
• CVE-2011-2523 Security Advisory

Author

Nitin Sukthe

Cybersecurity | Cloud Security | AI Security | Vulnerability Management