Take the 2-minute tour ×

I have configured the OpenVAS server as per wiki instructions:


And i ran the following commands:

load openvas
openvas_connect admin toor 9390
openvas_target_create Metasploitable "Target Machine"
openvas_task_create Scan1 Scan1 3 1

When i download the report, it doens't show any vulns. Can someone tell me what i did wrong?

Both BT5 and Metasploitable are run in VirtualBox with host only adapters, and BT5 can ping the ip address of the metasploitable target machine.

share|improve this question
What happens when you run OpenVAS by itself on the target? Does it return results? –  schroeder May 28 '12 at 21:26
I assume you specified the task to start in your "openvas_task_start" ... Does openvas_report_list show a report, or is the report empty? –  schroeder May 28 '12 at 21:35
I did indeed specify openvas_task_start. openvas_report_list did indeed show a report, but the report is blank when i did downloaded and viewed it. I have not tried OpenVAS by itself, i will do so when i have access to backtrack again. –  Terry Chia May 29 '12 at 6:52

1 Answer 1

up vote 0 down vote accepted

Its difficult to tell what limiting network factors might be involved without a full network map, but if you have both operating systems running within Virtualbox on the same host, I would guess that its a virtualbox issue. You've got one os trying to scan the other os's network stack, while both networks are using the same network card. Switching to bridged and using a different connector for each would likely return more accurate results.

To test if the backtrack vm can even communicate with the metasploitable one, I would suggest trying to set up a telnet or ssh connection between the two, or to open up a netcat listener on the metasploitable box and scan it with nmap. Usually a vulnerability scanner reporting nothing at all is indicative of networking issues.

share|improve this answer
I can telnet the other machine from backtrack. Using nmap for port scanning returns the expected results. Running nikto against metasploitable returns vulnerabilities i can use. Exploiting said vulnerability with metasploit works as well. All factors point to an openVAS misconfiguration, but i have followed the instructions in the backtrack wiki exactly. This is very puzzling. –  Terry Chia May 28 '12 at 0:38
Have you updated the openVAS nvts? If you haven't openVAS will have no vulnerabilities to test out. backtrack-linux.org/wiki/index.php/OpenVas –  sublimepua May 28 '12 at 0:42
Yes, i ran openvas-nvt-sync everytime i turned on backtrack. –  Terry Chia May 28 '12 at 0:43
Wait... does both backtrack and the metasploitable vm have the same ip address at If so, you're basically scanning yourself from within yourself. –  sublimepua May 28 '12 at 1:18
Backtrack has the IP, metasploitable has the IP Very puzzling situation. I think i might try another vulnerability scanner like nessus or nexpose instead. –  Terry Chia May 28 '12 at 1:33

Your Answer


