Slashdot Mirror

There are some good points in the article, but the article from issue 154 is out of date. It refers to the proprietary tool, Nessus, which has been surpassed by OpenVAS. OpenVAS does not even get a mention, despite being useful, GPL software.

Disclosure: I am an OpenVAS developer...

Nmap does what it does very well. It would be a strange day that I stop using it for pentesting, in fact more likely I'll adopt some of the other tools the project has developed. Ncat in particular sounds great simply because it unifies multiple functions I currently use from other tools. The other thing I like is the NSE, great for quickly cooking up a scanner for 0day threats as we saw with Conficker check they produced.

If you want a Free Software vulnerability scanner, then support OpenVAS. The project is making quiet progress (cleaning up the code base, redesigning the architecture and most importantly adding new NVTs) and has just had a second DevCon in Germany with 16 developers from 4 continents making the trip. Nothings ever perfect but it now has NVT that are not in Nessus so if you're not using it, you're probably missing out. It's worth noting that we at OpenVAS like the nmap developments so much that a couple of the OpenVAS developers are looking to actively contribute and we're considering libnmap as a replacement for the rather fragile port / service discovery functionality we inherited.

The irony of the situation is that the German government actively sponsors work on security tools such as GPG, OpenVAS, BOSS.

If you don't trust closed source security products, if you would prefer to have the support of a worldwide community rather than a small handful of developers, use OpenVAS.

It has forked though. Here's their DokuWiki link

http://www.openvas.org/doku.php?id=

http://www.openvas.org/doku.php

open source fork of nessus 2: http://www.openvas.org/

Two forks are mentioned on wikipedia:
OpenVAS
Porz-Wahn