Scan Metasploitable with OpenVAS

A port number isn't a finding

What you'll need

A second stack, alongside Lab 12's

1. Download the official Compose file into its own folder:

   mkdir C:\labs\greenbone-community-edition
   cd C:\labs\greenbone-community-edition
   curl.exe -L -o compose.yaml https://greenbone.github.io/docs/latest/_static/compose.yaml

   Copy

   Use curl.exe specifically — plain curl in PowerShell is an alias for Invoke-WebRequest and takes different flags.
2. Bring it up:

   docker compose up -d

   Copy

   First start pulls a stack of containers and kicks off the vulnerability feed sync in the background — that sync is most of this lab's time budget, and there's nothing to click to speed it up.
3. Set the admin password — this creates the login, there's no default admin/admin on this image:

   docker compose exec -u gvmd gvmd gvmd --user=admin --new-password=choose-one

   Copy
4. Open the web interface at https://127.0.0.1, accept the self-signed certificate warning, and log in as admin with the password you just set.

Two Compose stacks, bridged by hand

1. Confirm the network Compose created:

   docker network ls

   Copy

   Look for greenbone-community-edition_default — Compose names it after the folder holding the file.
2. Attach Lab 12's running Metasploitable container to it:

   docker network connect greenbone-community-edition_default metasploitable

   Copy

   This adds a second network to an already-running container — it stays reachable on Lab 12's lab_net too.
3. Get its address on the new network — this IP is what you'll scan, not a hostname:

   docker inspect metasploitable --format "{{(index .NetworkSettings.Networks \"greenbone-community-edition_default\").IPAddress}}"

   Copy

From the web interface, not PowerShell

1. Create a target. In the GSA web UI: Configuration → Targets → New Target. Name it metasploitable and enter the IP address from Part 2 as the host.
2. Create and start a scan task. Scans → Tasks → New Task. Point it at the target you just made, leave the default “Full and fast” scan config, and start it.
3. Wait for it to finish. A single, lightly-patched host is a handful of minutes once the feed sync from Part 1 has actually completed — check the feed status first if the scan seems to be finding nothing.
4. Open the report and sort by severity. Find the vsftpd finding and open it. Note its CVE, its CVSS score, and the exact wording of the recommended fix — that's what goes in a real report, not just “vulnerable.”

Get more out of the same scan