Lion Cipher Lab
Stand up your own Greenbone/OpenVAS scanner and run a real vulnerability-management cycle
- Cyber / Security Engineer
- Intermediate
- ~2.5 hours of your attention, spread across a day (the feed sync runs unattended for hours)
- Free · no account required
Why it matters
Every organization that takes security seriously runs a vulnerability scanner against its own estate, on a schedule, forever. Greenbone Community Edition — the free stack built around the OpenVAS scan engine — is how most people get their first hands on that job without a purchase order. But almost everyone who tries it bounces off, and for two reasons that have nothing to do with security: the naming is genuinely confusing (three different names for overlapping things), and the first-run feed synchronisation takes hours, during which the scanner appears completely broken and returns almost…
What you'll learn
- untangling the OpenVAS / GVM / Greenbone Community Edition naming mess
- deploying the Greenbone Community Containers with Docker Compose
- understanding the stack's parts: gvmd, ospd-openvas, openvas-scanner, notus, GSA
- surviving the first-run NVT/SCAP/CERT feed sync and knowing when it's actually done
- replacing the default admin credential and logging into the GSA web interface
- verifying feed status before trusting a single result
- building credentials, targets and a scan config for an authenticated scan
- the vulnerability-management lifecycle: discover, assess, prioritize, remediate, rescan
- scheduling recurring scans so you get trend data instead of a one-off snapshot
- judgment: when a full Greenbone stand-up is worth it and when it is overkill
Steps in this lab
- First, the naming mess — because it will confuse you otherwise
- WHEN this is worth standing up — and when it is absolutely overkill
- The loop this tool exists to serve — read this or the rest is just clicking
- What you are about to install: the parts, in one picture
- Choosing an install path — containers, the Kali package, or source
- Download the official compose file and pull the images
- Start the stack and immediately kill the default password
- The feed sync — the single biggest reason people think this tool is broken
- Log into the GSA web interface
- Verify the feeds are current — before you trust a single result
- Build a credential — and understand WHY authenticated scanning changes everything
- Create the Target and choose a scan config
- Do it better: schedule it, diff it, rescan to prove the fix
- Keeping it alive, and shutting it down cleanly
- What you actually learned — and where to go next