Ostorlab / oxo

OXO is a security scanning orchestrator for the modern age.
https://oxo.ostorlab.co
Apache License 2.0
517 stars 52 forks source link

openvas agent stuck in loop #755

Open rfhacker opened 2 months ago

rfhacker commented 2 months ago

Installed on a kali linux system and it started this and assumed it was because Kali, so i installed a fresh Ubuntu box and getting same results.

When running the first scan example, i dont really notice any errors thrown, but the building of the openvas database seems to get stuck in a loop. The current GVMd database version is 255 each time it iterates through. The image feeds and installed feeds remain the same as well.

It seems to try 'Running first start configuration' over and over, using a different named tmp file each time (such as /tmp/tmp.4Qbo6s1bNC).

Any ideas for this, or missing steps in the setup?

thanks!

rfhacker commented 2 months ago

Just to add, i also ran it again leaving off the openvas agent. It seems that the scans complete, as i see "Done scanning targets." for both tsunami and nuclei...but it just sits there at this point and does nothing. I list scans and it still shows running. It has stayed this way overnight for the single ip of 8.8.8.8. I get the same results running the straight docker command. Are there some steps missing in the documentation for setting up yaml files or databases or something? Or perhaps this project hasn't updated for any latest tool updates?

3asm commented 2 months ago

OpenVAS agent is problematic because the first thing it does is fetch the vulnerability database. The agent will often hang or take a lot of time. This is unfortunately linked to OpenVAS and not OXO.

Nomadyb commented 1 month ago

Hi sir I’m experiencing the same issue. Is there any other solution for an OpenVAS agent?

3asm commented 1 month ago

We will try to look into it. Not the best answer, but Nuclei, Tsunami, Metasploit and Asteroid agents are very capable put together.

Nomadyb commented 1 month ago

Yes, thank you very much. The project is really great. My goal was this: I use GVM to perform scans with the help of Python and SSH, but unfortunately, OpenVAS doesn’t have an agent structure. I want to create an alternative for this