Adding nessus support to airoscript

OpenVAS, THE framework for vulnerability scanning and management, is normally used via it’s standard GUI, but I recently discovered it provides a nice batch mode, wich I’ll be using in this post to add it to airoscript, and make a little independient TUI for it.

OpenVAS strcutrue. Source: wikimedia commons

I know that plugins on airoscrip-ng are making it grow bigger than it should, this plugin isn’t even going to enter airoscript-ng on trunk. It’s just an example, for both OpenVAS batch usage and airoscript plugin making (making them portable)

I’m planning on making a simple  jabashit based interface to independently load airoscrit-compatible plugins, so that problem will be solved. Then, let’s have a look at the idea of having OpenVAS in airoscript via plugin, it’s fair simple:

enabled_plugins+="Scan selected client with OpenVAS"
wait_for_openvasd() {
    while [ "1" ]; do  ps aux|grep "openvasd: waiting for incoming connections" && break ; done
}

openvas_autodetect_hosts(){
    # Ok, this is not nice for this post, so for now I'll let it unimplemented.
}

rootify(){
    # So we are not forced to be root, and made it compatible with ubuntu and debian bot sudo and su.
    [[ $UID == 0 ]] && { $@; } || { [[ type -f sudo ]] && sudo $@ || su -c "$@"; }
}

yesno(){
    read -p "$@" ans
    [[ $ans ~= "y" ]] && return 0 || return 1
}

check_dump_path(){
    [[ -n $DUMP_PATH ]] && return 0 || return 1
}

Scan_selected_client_with_OpenVAS(){
    check_dump_path || DUMP_PATH="./"
    yesno "Have you already configured wireless interface?" || configure

    yesno "Autodetect hosts? (If not, you'll be asked to enter them)" && {
        openvas_autodetect_hosts
    } || {
        echo -e "Enter list of hosts, one line each, end with EOF"
        cat << EOF > $DUMP_PATH/available_hosts
    }

    pgrep openvasd || rootify "openvasd &>$DUMP_PATH/openvasd_log &"

    wait_for_openvasd && {
        read -p "Enter username: " user
        read -p "Enter password: " pass
        openvas-client -T html_graph -x -q localhost 9390 $user $pass $DUMP_PATH/available_hosts $DUMP_PATH/OpenVAS_results
    }
}

Let’s explain this a little. I’ve made a wait_for_openvasd function, wich will wait until openvas sais it’s waiting for incoming connections, so we can safely launch openvasd, then this and if this is successfull openvas-client.

The other two functions, yesno and check_dump_path are for airoscript-ng compatibility. So that right now, you can source that file wherever you want and execute  Scan_selected_client_with_OpenVAS and it will work.

I’ll be launching openvas-client in batch mode, without human interaction, and return results in HTML. If you’re in a configured interface, and with a file “Hosts” with all the hosts you want to test, you’d want to use this command:

pgrep openvasd || openvasd &> log &
wait_for_openvasd && openvas_client -T html_graph -x -q localhost 9390 YOUR_USER YOUR_PASS ./Hosts OpenVAS_results.html && x-www-browser OpenVAS_results.html

And you’ll get a nice graph opened in your web browser.