Vulnerability Scan and Remediation Report

Scan a vulnerable VM with OpenVAS and Nmap, then write a CVE-mapped briefing.

Introduction

30 Second Summary

When a company gets hacked, the first question is always "how did we not know about this?" The answer is usually that nobody ran a proper vulnerability scan, or they scanned but never turned the results into action.

In this project, you will set up an isolated vulnerability lab, scan a deliberately vulnerable target with two fundamentally different tool classes, and produce a professional remediation briefing that prioritizes what to fix first and why.

What You'll Build

You will run scans from two different tools, watch vulnerabilities pour in, then hand someone a polished PDF that says "here are the top things to fix this week, in this order, and here is why."

By the end of this project, you'll have:

  • A running OpenVAS scan that delivers a comprehensive vulnerability report with CVSS severity scores, CVE references, and remediation guidance you can walk through with a colleague.
  • An Nmap NSE vuln scan of the same target, showing you exactly what a network scanner detects versus what a dedicated vulnerability management platform catches.
  • A GitHub-hosted PDF vulnerability briefing with findings categorized by severity, mapped to CVEs, and ordered into a prioritized remediation plan you can present to a team.
  • Secret Mission: Configure authenticated scanning credentials in OpenVAS and re-scan to demonstrate the dramatic detection uplift from credentialed access.

Are there any prerequisites?

No prior cybersecurity experience is required. This guide walks you through setting up every tool from scratch.

You will need a Windows machine with VirtualBox, Docker Desktop, and Git already installed, plus at least 32 GB of RAM to run the scanning containers comfortably alongside the target VM.

Before We Start

Before we dive in, let's lock in what you're about to build and why it matters.

Set Up the Vulnerability Lab

Before you can scan for vulnerabilities, you need something to scan. You also need the scanning tools themselves running and ready.

In this step, you will build an isolated lab environment with an intentionally vulnerable target VM, deploy a full vulnerability management platform, and confirm your network scanner can reach the target.

In this step, get ready to:
  • Import Metasploitable 2 into VirtualBox as your scan target.
  • Deploy Greenbone Community Edition (OpenVAS) via Docker Compose.
  • Verify Nmap can reach the target VM from your Windows host.
Download and import Metasploitable 2 into VirtualBox

Metasploitable 2 is a purposefully vulnerable Linux VM packed with dozens of known security flaws. It acts as your scan target throughout this project.

Now create a VM in VirtualBox to host this disk.

  • Open VirtualBox.
  • Click New in the toolbar.
  • Set Name to Metasploitable2.
  • Set Type to Linux.
  • Set Version to Other Linux (64-bit).
  • Click Next.
  • Set memory to 512 MB.
  • Click Next.
  • On the Hard Disk screen, select Use an existing virtual hard disk file.
  • Click the folder icon, then Add.
  • Navigate to the extracted .vmdk file and select it.
  • Click Create to finish.

Before booting, you need to configure the network adapter so the VM stays isolated on a Host-Only network.

  • First, ensure a Host-Only network exists. In VirtualBox, click File in the menu bar.
  • Select Tools, then click Network Manager.
  • Click the Host-Only Networks tab.
  • If no network is listed, click Create to add one. A new adapter will appear with default settings (DHCP enabled).
  • Close Network Manager.
  • Right-click your Metasploitable2 VM and select Settings.
  • Go to Network.
  • Under Adapter 1, ensure Enable Network Adapter is checked.
  • In the Attached to dropdown, select Host-Only Adapter.
  • Click OK.

Why Host-Only networking?

Metasploitable 2 is intentionally packed with exploitable vulnerabilities. A Host-Only adapter creates a private network between the VM and your Windows host, with no route to the internet. This keeps the vulnerable machine completely isolated from external networks.

Now boot the VM and confirm it has an IP address.

  • Select the Metasploitable2 VM in VirtualBox and click Start.
  • Wait for the login prompt to appear.
  • Log in with username msfadmin and password msfadmin.
  • Run the following command inside the VM to check its IP address:
ifconfig
  • Look at the inet addr value on the eth0 interface. It will be something like 192.168.56.101. Write this IP down.

What does this IP mean?

The 192.168.56.x range is the default subnet for VirtualBox Host-Only networks. The built-in DHCP server assigned this address to your VM automatically. You will use this IP every time you point a scanner at the target.

Don't see an IP address on eth0?

If eth0 shows no inet addr, the Host-Only network may not have a DHCP server enabled. Go back to File > Tools > Network Manager, select your Host-Only network, click Properties, then the DHCP Server tab, and ensure Enable Server is checked. After enabling it, reboot the VM.

help me troubleshoot my Metasploitable 2 VM not getting an IP address on the VirtualBox Host-Only network

Deploy Greenbone Community Edition via Docker Compose

Greenbone Community Edition (the open-source engine behind OpenVAS) is a full vulnerability management platform. It uses tens of thousands of Network Vulnerability Tests to actively probe targets for weaknesses.

  • Open PowerShell as Administrator by pressing the Windows key, typing PowerShell, right-clicking Windows PowerShell, and selecting Run as administrator.
  • Set a download directory variable and create the folder by running these commands:
$DOWNLOAD_DIR = "$HOME\greenbone-community-containers"
mkdir -Force $DOWNLOAD_DIR
  • Download the Docker Compose file by running:
curl -f -O -L https://greenbone.github.io/docs/latest/_static/compose.yaml --output-dir "$DOWNLOAD_DIR"

What does this command do?

This downloads the official compose.yaml that defines all of Greenbone's container services: the vulnerability manager (gvmd), the scanner (ospd-openvas), the web API (gsad), and several feed data containers that provide vulnerability definitions.

  • Pull all the container images by running:
docker compose -f $DOWNLOAD_DIR/compose.yaml pull

This download is several gigabytes. It may take a few minutes depending on your connection speed.

  • Start the containers by running:
docker compose -f $DOWNLOAD_DIR/compose.yaml up -d
  • Check that the feed data is loading by running:
docker compose -f $DOWNLOAD_DIR/compose.yaml logs -f

How long does the feed sync take?

On first startup, the feed data containers copy pre-packaged vulnerability definitions into shared volumes. Then gvmd imports them into its PostgreSQL database. This can take several minutes depending on your system resources. You have 32 GB RAM, so it should complete relatively quickly.

Watch the logs until you see gvmd reporting that the feed import is complete or that the daemon is ready. Press Ctrl+C to exit the log view once you see this.

  • Open your browser and navigate to https://127.0.0.1:9392.

Accept the self-signed certificate

Your browser will warn you about an untrusted certificate. This is expected because the Greenbone containers use a self-signed SSL certificate. Click Advanced and then Proceed (or Accept the Risk depending on your browser).

  • Log in with username admin and password admin.

You should see the Greenbone Security Assistant (GSA) dashboard. This confirms your vulnerability management platform is running.

Can't reach the web UI?

If the page does not load, the containers may still be starting. Run docker compose -f $DOWNLOAD_DIR/compose.yaml ps to check that all containers show a healthy or running status. If any container is restarting, wait a minute and refresh.

Make sure Docker Desktop is running. If you stopped it since pulling the images, start Docker Desktop again and re-run the up -d command.

help me troubleshoot Greenbone Community Edition containers not starting properly

Verify Nmap is installed and can reach the target

Nmap is a network scanner that discovers hosts and services on a network. You will use it alongside its NSE (Nmap Scripting Engine) vulnerability scripts to get a fast, lightweight scan of the target.

  • In your PowerShell window, check if Nmap is already installed by running:
nmap --version

✔️ I see a version number

Nmap is already installed. You are ready to test connectivity.

ⓧ Command not found

You need to install Nmap from the official website.

  • Open your browser and go to https://nmap.org/download.
  • Download the latest Windows self-installer (the .exe file).
  • Run the installer. It will prompt you to install Npcap (a packet capture library that Nmap needs). Accept all defaults and proceed through the prompts.
  • Once installation completes, close and reopen your PowerShell window so it picks up the new PATH entries.
  • Run nmap --version again to confirm the installation succeeded.

Still seeing 'command not found' after install?

The Nmap installer adds itself to your system PATH, but an already-open PowerShell session will not pick up the change. Close the PowerShell window entirely and open a new one. If it still fails, check that C:\Program Files (x86)\Nmap exists and is listed in your system PATH environment variable.

help me fix Nmap not being found in my Windows PATH after installation

Now test that Nmap can reach your Metasploitable 2 VM across the Host-Only network.

Before you run this, what do you expect to see? A host discovery scan on the Host-Only subnet should find the VM you just booted.

  • Run a ping scan against the Host-Only subnet by running:
nmap -sn 192.168.56.0/24

You should see output listing at least two hosts: the VirtualBox Host-Only adapter on your Windows machine and the Metasploitable 2 VM at the IP you noted earlier.

What does this command do?

The -sn flag tells Nmap to perform a host discovery scan without port scanning. It sends ARP requests on local subnets to find which hosts are up. The /24 specifies the entire 256-address subnet, so Nmap checks every address in the 192.168.56.0 range.

Metasploitable 2 not showing up?

Confirm the VM is still running in VirtualBox. If the VM is powered off, start it again and wait for the login prompt.

Double-check that both the VM's network adapter and the Host-Only network adapter on your host are on the same 192.168.56.x subnet. You can verify by running ipconfig in PowerShell and looking for the VirtualBox Host-Only adapter.

help me troubleshoot Nmap not finding my Metasploitable 2 VM on the Host-Only network

Your lab is live. You have a vulnerable target isolated on a private network, a full vulnerability management platform loaded with feed data, and a network scanner proven to reach the target. Next up, you will put Nmap to work scanning for actual vulnerabilities.

Run Nmap NSE Vulnerability Scan

You need a baseline of what a fast network scanner with vulnerability scripts can detect. Nmap gives you immediate results, but the findings will be shallower than what a dedicated vulnerability management platform produces.

In this step, you will run Nmap with NSE vulnerability scripts against Metasploitable 2, review the findings for CVE IDs and severity scores, and organize your project directory for the report you will build later.

In this step, get ready to:
  • Run Nmap with vuln and vulners scripts against the target.
  • Review CVE findings and CVSS scores in the scan output.
  • Create a project directory and organize raw scan data.
Run the vulnerability scan

Nmap's Scripting Engine (NSE) includes a vuln category of scripts that check for specific known vulnerabilities. The vulners script goes further by querying the vulners.com API with version data to fetch known CVEs and CVSS scores.

  • Switch back to your PowerShell window.
  • Move to your Desktop by running this command:
cd ~/Desktop
  • Run the vulnerability scan against your Metasploitable 2 target by running this command:
nmap -sV --script vuln,vulners -oA nmap_vuln_scan [[METASPLOITABLE_IP="your Metasploitable 2 IP address"]]

What does this command do?

  • -sV tells Nmap to detect the version of each service running on open ports.
  • --script vuln,vulners loads two script sets: the built-in vuln category (active checks for known vulnerabilities) and the vulners script (queries vulners.com with CPE data to fetch CVE IDs and CVSS scores).
  • -oA nmap_vuln_scan exports results in all three formats simultaneously: normal text (.nmap), XML (.xml), and grepable (.gnmap).

This scan takes 2-5 minutes. Watch the terminal output as Nmap discovers open ports and checks each one for vulnerabilities.

You should see services like FTP, SSH, HTTP, and SMB appear with vulnerability findings listed beneath each port.

Scan hanging or no output?

  • Confirm your Metasploitable 2 VM is still running in VirtualBox.
  • Double-check the IP address matches what you noted from ifconfig in Step 1.
  • The vulners script requires internet access to query vulners.com. Confirm your Windows host has an active internet connection.

Help me troubleshoot why my Nmap vulnerability scan is not producing results against Metasploitable 2.

Review the scan results

The scan produced three output files on your Desktop. The .nmap file contains human-readable results that are easiest to review first.

  • Open the normal output file in Notepad by running:
notepad nmap_vuln_scan.nmap
  • Scroll through the file and note which ports have vulnerability findings listed beneath them.
  • Look for lines containing CVE- followed by a year and number. These are unique vulnerability identifiers.
  • Find the CVSS scores (decimal numbers like 9.8 or 7.5) next to each CVE. Higher scores mean more severe vulnerabilities.

How does Nmap detect these vulnerabilities?

Nmap does not verify whether each vulnerability is actually exploitable. The vulners script works by matching the detected service version (a CPE identifier) against the vulners.com database.

If a service reports itself as running version X, and version X has known CVEs, those CVEs appear in the output. This is version-matching, not active exploitation testing.

You should see dozens of CVE entries across multiple services. Keep Notepad open for reference as you build your report later.

Create the project directory and organize data

Your scan data needs a structured home. You will create a Git repository that holds both raw scan output and the final report.

  • Create your project directory and initialize a Git repository by running these commands:
mkdir vuln-assessment
cd vuln-assessment
git init

You should see a confirmation message: Initialized empty Git repository followed by the path to your new repository.

  • Create subdirectories for raw data and the report by running:
mkdir raw-data
mkdir report
  • Move the Nmap output files from your Desktop into the raw data directory by running:
Move-Item ../nmap_vuln_scan.* ./raw-data/
  • Confirm the files are in place by running:
ls raw-data

You should see three files listed: nmap_vuln_scan.gnmap, nmap_vuln_scan.nmap, and nmap_vuln_scan.xml.

Files not found when moving?

  • The ../ path assumes you are inside the vuln-assessment folder on your Desktop. Run pwd to check your current location.
  • If you ran the Nmap scan from a different directory, adjust the source path in the Move-Item command to point to where the nmap_vuln_scan.* files actually live.

Help me find and move my Nmap scan output files into my project's raw-data directory.

Before you run the next command, predict what you will find inside the XML file. Do you expect to see CVE IDs and CVSS scores, or just port numbers?

  • Search the XML file for CVE references by running:
Select-String -Path raw-data/nmap_vuln_scan.xml -Pattern "CVE-"

You should see multiple lines of output, each containing a CVE identifier like CVE-2007-6750 or similar. This confirms your XML export captured the full vulnerability data from the vulners script, including CVE mappings and CVSS scores for multiple services.

Your scan baseline is locked in. Next up, you will run a full OpenVAS scan against the same target and see how a dedicated vulnerability management platform compares to what Nmap found.

Run OpenVAS Full Vulnerability Scan

Your Nmap scan gave you a quick baseline of vulnerabilities detected through version matching. That approach works by looking up known CVEs for each service version it finds on the network.

A dedicated vulnerability management platform like OpenVAS goes much deeper. It runs tens of thousands of Network Vulnerability Tests (NVTs) that actively probe for configuration weaknesses, default credentials, and application-layer flaws that version matching alone cannot detect.

In this step, get ready to:
  • Create a scan target in the GSA web interface pointing at your Metasploitable 2 VM.
  • Launch a full vulnerability scan and monitor it to completion.
  • Export the scan report as CSV for later comparison with Nmap results.
Create a new target in GSA

Before OpenVAS can scan anything, it needs a Target definition that tells it which host to probe. You will point it at the same Metasploitable 2 IP that Nmap scanned.

  • Switch back to the GSA web interface in your browser at https://127.0.0.1:9392.
  • In the top navigation bar, click Configuration.
  • Select Targets from the dropdown menu.
  • Click the New Target icon (a page with a star) in the top-left area of the Targets page.
  • In the Name field, enter Metasploitable 2.
  • In the Hosts field, enter the IP address of your Metasploitable 2 VM (the 192.168.56.x address you noted earlier).
  • Leave the Credentials sections blank. This is intentional. You are running an unauthenticated scan, which only sees what is exposed on the network.
  • Click Save.

You should see your new Metasploitable 2 target appear in the Targets list.

Why leave credentials blank?

An unauthenticated scan only probes what is reachable from the network. It cannot log into the target to inspect installed packages or local configurations.

This mirrors a real attacker's perspective. The Secret Mission later adds credentials to show how much more a logged-in scan reveals.

Don't see the New Target option?

Make sure you are logged in as admin. Only admin users can create targets and tasks.

If the Targets page is empty or shows a loading spinner, the feed data may still be syncing. Check Docker logs to confirm feeds have finished importing.

Help me troubleshoot this

Create and launch a scan task

With a target defined, you now create a Task that tells OpenVAS which scan configuration to use and when to start.

  • In the top navigation bar, click Scans.
  • Select Tasks from the dropdown menu.
  • Click the New Task icon (a page with a star) in the top-left area of the Tasks page.
  • In the Name field, enter Full Scan - Metasploitable 2.
  • In the Scan Targets dropdown, select the Metasploitable 2 target you just created.
  • In the Scan Config dropdown, select Full and fast.
  • Leave all other fields at their defaults.
  • Click Save.

Your new task appears in the Tasks list with status New.

  • Click the Start button (green play icon) next to your task to launch the scan.

The status changes to Requested and then Running within a few seconds.

What is the Full and fast scan config?

This configuration runs the full set of NVTs but skips tests that are likely to crash the target or take excessive time. It is the recommended default for most vulnerability assessments.

For Metasploitable 2, expect this scan to take 10-20 minutes depending on your system resources. The progress bar in the Tasks list updates as it runs.

Use the wait productively

While the scan runs, review your Nmap results from the previous step. Count how many unique CVEs Nmap detected and note which services had findings. You will compare this against the OpenVAS results shortly.

  • Refresh the Tasks page periodically until the status column shows Done.

Scan stuck at 0% or showing errors?

Confirm your Metasploitable 2 VM is still running and reachable from the host. Open PowerShell and run ping against the VM's IP to verify connectivity.

If the scan shows an error about the scanner being unavailable, the ospd-openvas container may have restarted. Check container status with docker ps and restart if needed.

Help me troubleshoot my scan

Export the scan report

Once the scan finishes, you need to pull the results out of the web interface so you can compare them with your Nmap data in the next step.

  • In the Tasks list, click on the name of your completed task (Full Scan - Metasploitable 2).
  • Click on the date link under the Last Report column to open the full report.

You should see findings categorized by severity: High, Medium, and Low, each with CVE references.

Before you export, take a moment to predict. Do you expect more or fewer findings here than your Nmap scan produced?

  • Click the download icon (arrow pointing down) near the top of the report page.
  • From the format dropdown, select CSV Results.
  • Click OK to download the file.
  • Move the downloaded CSV file into your raw data directory alongside the Nmap output files.
  • Rename it to openvas_report.csv for consistency.

Confirm the file is in place by checking your raw data directory. You should see openvas_report.csv alongside your Nmap output files.

What does the CSV contain?

Each row represents a single finding with columns for the IP, port, hostname, NVT name, severity score, CVE references, and a description. This structured format makes it straightforward to cross-reference against your Nmap XML in the next step.

Download not starting?

Some browsers block downloads from self-signed HTTPS sites. If the download fails, try right-clicking the download link and selecting Save link as.

If the report page shows no results, verify your scan status is Done (not Running or Interrupted).

Help me troubleshoot the report export

You now have two complete scan result sets sitting side by side in your raw data directory. Next up, you will cross-reference these findings to build a professional vulnerability briefing that shows what each tool caught and what to fix first.

Compare Findings and Build the Remediation Briefing

You now have two complete scan result sets sitting in your raw data directory. One from Nmap with its version-matching approach, and one from OpenVAS with its active vulnerability probing.

Raw scan output is not intelligence. The value a security analyst brings is cross-referencing findings between tools, identifying what each missed, and translating a pile of CVEs into a prioritized action plan. In this step, you will do exactly that and package the results as a professional PDF briefing.

In this step, get ready to:
  • Cross-reference CVE findings between Nmap and OpenVAS to identify overlap and gaps.
  • Write a structured Markdown vulnerability briefing with severity categorization and remediation recommendations.
  • Convert the briefing to PDF and push it to a GitHub repository.
Cross-reference your scan results

Both tools scanned the same Metasploitable 2 target, but they detect vulnerabilities in fundamentally different ways. Nmap uses CPE version matching via the vulners.com API. OpenVAS uses tens of thousands of Network Vulnerability Tests (NVTs) that actively probe for weaknesses.

  • Open nmap_vuln_scan.nmap in a text editor. Scroll through and note every CVE ID reported alongside its port and service.
  • Open openvas_report.csv in a spreadsheet application or text editor. Note the columns for CVE ID, severity, host, port, and solution.

As you review both files, build three lists (on paper or in a scratch file):

  • CVEs found by both tools (the overlap).
  • CVEs unique to OpenVAS (these are typically configuration issues, default credentials, and application-layer flaws invisible to version matching).
  • CVEs unique to Nmap/vulners (these often come from version-based CPE lookups that OpenVAS may score differently or skip).
  • Count the total unique CVEs from each tool.
  • Flag any severity disagreements where the same CVE has a different CVSS score between sources.

What is the detection gap?

OpenVAS will typically find more findings than Nmap because it actively tests for configuration weaknesses, checks for default credentials, and probes application-layer issues.

Nmap's vulners script relies on matching the service version string to known CVEs in the vulners.com database. If a service reports its version, Nmap finds every public CVE for that version. But it cannot verify whether the vulnerability is actually exploitable on this specific host.

Why do CVSS scores sometimes disagree?

The vulners.com API may report the base CVSS score from the NVD (National Vulnerability Database), while OpenVAS may adjust scores based on its own assessment or use a different CVSS version. Documenting these disagreements shows analytical maturity in your briefing.

Write the vulnerability briefing in Markdown

Your briefing follows the structure that security teams expect: executive summary first, then detail, then action. You will create a single report.md file in your project root directory.

  • Create a new file called report.md in your project root by running:
New-Item report.md
  • Open report.md in your text editor and paste the following header and executive summary section:
# Vulnerability Assessment Briefing

## Executive Summary

<!-- Replace this comment with 1 paragraph summarizing:
     total findings from both tools, severity breakdown,
     most critical issue discovered, and your top recommendation. -->

## Methodology

| Parameter | Value |
|-----------|-------|
| Target | Metasploitable 2 (192.168.56.x) |
| Scan Date | 2026-08-04 |
| Nmap Version | (your nmap --version output) |
| OpenVAS | Greenbone Community Edition (Docker) |
| Scan Type | Unauthenticated remote network scan |

Nmap was run with `-sV --script vuln,vulners` for version detection
and vulnerability matching. OpenVAS used the "Full and fast" scan
configuration with no credentials.

What does this section do?

The executive summary gives a decision-maker the bottom line in one paragraph. The methodology section ensures anyone reading your report knows exactly how you gathered data, making your findings reproducible.

  • Save report.md and confirm it exists by running:
dir report.md

You should see report.md listed with its file size confirming content was written.

  • Now add the Findings by Severity section below your methodology. Paste this template and fill in rows from your cross-reference analysis:
## Findings by Severity

### Critical

| CVE ID | Service/Port | CVSS | Description | Detected By | Remediation |
|--------|-------------|------|-------------|-------------|-------------|
| CVE-XXXX-XXXX | service/port | 9.x | Description | Nmap/OpenVAS/Both | Recommendation |

### High

| CVE ID | Service/Port | CVSS | Description | Detected By | Remediation |
|--------|-------------|------|-------------|-------------|-------------|
| CVE-XXXX-XXXX | service/port | 7.x | Description | Nmap/OpenVAS/Both | Recommendation |

### Medium

| CVE ID | Service/Port | CVSS | Description | Detected By | Remediation |
|--------|-------------|------|-------------|-------------|-------------|
| CVE-XXXX-XXXX | service/port | 4.x | Description | Nmap/OpenVAS/Both | Recommendation |

### Low

| CVE ID | Service/Port | CVSS | Description | Detected By | Remediation |
|--------|-------------|------|-------------|-------------|-------------|
| CVE-XXXX-XXXX | service/port | 2.x | Description | Nmap/OpenVAS/Both | Recommendation |

How do I fill in this table?

Pull the CVE IDs directly from your scan results. For Nmap findings, look at the vulners output per port in nmap_vuln_scan.nmap. For OpenVAS findings, use the CVE and severity columns from openvas_report.csv.

Add one row per unique CVE. In the "Detected By" column, note whether Nmap found it, OpenVAS found it, or both did. For remediation, state the specific fix: upgrade the package, disable the service, change a default credential, or apply a configuration hardening.

  • Add the Coverage Comparison table and Prioritized Remediation Plan below your findings. Paste this final section:
## Coverage Comparison

| Metric | Nmap NSE/Vulners | OpenVAS |
|--------|-----------------|--------|
| Total unique CVEs detected | (your count) | (your count) |
| Overlapping CVEs (both tools) | (count) | (count) |
| Unique to this tool only | (count) | (count) |
| Configuration issues found | No | Yes |
| Default credential checks | No | Yes |
| Active exploit verification | No | Partial |

## Prioritized Remediation Plan

1. (Highest-risk action with justification)
2. (Second-priority action)
3. (Third-priority action)
4. (Fourth-priority action)
5. (Fifth-priority action)

How do I prioritize remediation?

Order your top 5 actions by risk reduction, not just CVSS score. A critical vulnerability on an internet-facing service is higher priority than a critical vulnerability on an internal-only port. Factor in exploitability, exposure, and blast radius.

  • Save report.md with all your findings filled in from the cross-reference analysis.
  • Review the file end-to-end to confirm every section has real data from your scans.

Fill in at least 3 real CVEs per severity level

Metasploitable 2 has dozens of known vulnerabilities. Your report is more valuable when each severity level has real entries. If you only found one Critical, that is fine. Categorize honestly based on the CVSS scores in your results.

Install Pandoc and convert to PDF

Pandoc is a document converter that transforms Markdown into PDF, HTML, DOCX, and many other formats. You will also need wkhtmltopdf as the PDF rendering engine.

  • Check whether Pandoc is already installed by running:
pandoc --version

✔️ I see a version number

Pandoc is ready. Move on to installing the PDF engine below.

ⓧ Command not found

  • Install Pandoc by running:
winget install JohnMacFarlane.Pandoc
  • Close and reopen your PowerShell window so the new PATH entry takes effect.
  • Verify the install succeeded by running:
pandoc --version

You should now see the Pandoc version printed.

  • Install the wkhtmltopdf PDF engine by running:
winget install wkhtmltopdf.wkhtmltox

Why do you need wkhtmltopdf?

Pandoc converts Markdown to an intermediate format but needs a separate engine to render the final PDF. The wkhtmltopdf engine converts HTML to PDF using a headless WebKit renderer and installs quickly on Windows.

  • Close and reopen your PowerShell window again to pick up the new PATH entry for wkhtmltopdf.

Before you run the conversion, predict: do you think report.md will produce a clean PDF on the first try, or will there be formatting issues?

  • Generate the PDF from your Markdown report by running:
pandoc report.md -o report.pdf --pdf-engine=wkhtmltopdf
  • Confirm the PDF was created by running:
dir report.pdf

You should see report.pdf listed. Open it in your PDF viewer to confirm it contains all your sections: Executive Summary, Methodology, Findings by Severity with CVE IDs, Coverage Comparison table, and Prioritized Remediation Plan.

PDF generation failed?

  • If you see an error about wkhtmltopdf not being found, close and reopen PowerShell to refresh your PATH, then try the command again.
  • If you see Markdown syntax errors in the output, check that your tables have consistent column separators and that headings use ## with a space before the title text.

Help me troubleshoot my Pandoc PDF generation error.

Push your report to GitHub

The final deliverable is a GitHub repository containing your raw scan data, the Markdown source, and the PDF briefing.

  • Stage all project files by running:
git add .
  • Commit all files with a descriptive message by running:
git commit -m "Add vulnerability assessment briefing with Nmap and OpenVAS results"
  • Open your browser and go to https://github.com/new to create a new repository.
  • Enter a repository name (for example, vuln-assessment-briefing) and click Create repository.
  • Copy the remote URL shown on the new repository page.
  • Add the remote and push by running these commands (replace the URL with your own):
git remote add origin [[YOUR_REPO_URL="https://github.com/YOUR_USERNAME/vuln-assessment-briefing.git"]]
git branch -M main
git push -u origin main
  • Refresh your GitHub repository page in the browser.

You should see your raw data directory, report.md, and report.pdf all listed in the repository.

Push rejected or authentication error?

  • If Git asks for credentials, you may need to set up a personal access token or SSH key in your GitHub settings.
  • If the push is rejected because the remote has files you do not have locally (like a README), run git pull --rebase origin main first, then push again.

Help me push my local Git repository to GitHub.

Your vulnerability assessment is now a published deliverable. Next up, you will take your scanning further with authenticated credentials that reveal what unauthenticated scanning misses.

Secret mission

Authenticated Scanning Uplift

Your unauthenticated scan found vulnerabilities visible from the network. But what about the ones hiding inside the target? Authenticated scanning logs into the machine and inspects local packages, kernel versions, and file permissions. In this mission, you will configure SSH credentials in OpenVAS, re-scan the same target, and document the dramatic detection uplift that credentialed access provides.

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely locally with a free GitHub repository, so there are no ongoing costs.

Resources you used:

  • Metasploitable 2 VM in VirtualBox (local storage only).
  • Greenbone Community Edition Docker containers (local disk and RAM).
  • GitHub repository with your vulnerability briefing.
  • Local project folder containing raw scan data, report source, and PDF.

Keep everything running

No action needed. Choose this if you are still actively experimenting with your vulnerability lab.

  • The Greenbone containers use roughly 4 GB of RAM while running.
  • The Metasploitable 2 VM uses 512 MB of RAM while running and several GB of disk space for the .vmdk file.
  • Your GitHub repository remains free indefinitely.

Pause - I'll come back to this later

Shut down running processes to free up RAM. Your files and configurations stay intact so you can resume later.

  • In VirtualBox Manager, right-click your Metasploitable 2 VM and select Close, then Power Off.
  • Stop the Greenbone containers by running this command in PowerShell:
docker compose -f $DOWNLOAD_DIR/compose.yaml stop
  • To restart the lab later, boot the VM from VirtualBox and run:
docker compose -f $DOWNLOAD_DIR/compose.yaml up -d

Delete - I don't want to use this again

Remove all project resources and start fresh. This is permanent.

Remove the Metasploitable 2 VM:

  • In VirtualBox Manager, make sure the Metasploitable 2 VM is powered off.
  • Right-click the VM and select Remove.
  • In the confirmation dialog, click Delete all files to remove the VM and its .vmdk disk image from your system.

Remove the Greenbone containers and volumes:

  • Run this command in PowerShell:
docker compose -f $DOWNLOAD_DIR/compose.yaml down -v
  • Delete the download directory that held the compose file:
Remove-Item -Recurse -Force $DOWNLOAD_DIR

Delete local project files:

  • Delete your project folder from your Desktop (or wherever you created it) using File Explorer or by running:
Remove-Item -Recurse -Force ~\Desktop\your-project-folder

Delete the GitHub repository:

  • Go to your repository page on GitHub.
  • Click Settings.
  • Scroll to the bottom to the Danger Zone section.
  • Click Delete this repository and follow the confirmation prompts to permanently remove it.

Nice Work!

Nice Work!

You just delivered the same artifact a junior security analyst produces in their first week on the job. You stood up an isolated vulnerability lab, operated two fundamentally different scanner classes against the same target, and translated raw output into a prioritized remediation briefing.

You've learned how to:

  • Scan a target with both Nmap NSE vuln scripts and Greenbone Community Edition (OpenVAS), then compare detection coverage between a network scanner and a dedicated vulnerability management platform.
  • Cross-reference findings by CVE ID and CVSS score, identifying which vulnerabilities each tool catches and which it misses.
  • Produce a professional vulnerability assessment briefing with severity categorization, a coverage comparison table, and prioritized remediation recommendations, converted to PDF and hosted on GitHub.
  • Secret Mission: Configured authenticated scanning credentials in OpenVAS and documented the dramatic detection uplift over unauthenticated scanning.

Ready to quiz yourself?