How to Install and Use Vuls Vulnerability Scanner on Ubuntu 22.04

Vuls is an agentless, free, and open-source vulnerability scanner for Linux and FreeBSD. Vuls is mainly written in Go and can be run anywhere. You can run Vuls on Cloud, on-premise, and Docker, and supports major distributions. Vuls provides high-quality scan that supports multiple vulnerability databases such as NVD, JVN, OVAL, RHSA/ALAS/ELSA/FreeBSD-SA.

With Vuls, you can scan multiple operating systems with multiple methods. You can scan the local of your host, and also you can scan remote hosts/servers via SSH. It also provides multiple methods for scanning, a fast scan that does not require root privileges, and a deep scan that required root privileges. Vuls can scan multiple target servers at once. when the scan is finished, you can send the result via Email and Slack.

In this tutorial, you will install Vuls - an open-source and agent-less vulnerability scanner - on an Ubuntu 22.04 server. You will also set up Vuls by creating the configuration file and building Vuls databases via the command-line tools provided by Vuls. Then, you will also scan your server with Vuls and scan the remote server via SSH and Vuls.

This tutorial also includes installing and integrating VulsRepo - a web application that allows you to show Vuls scan results via web browser - with Vuls.

Prerequisites

To complete this guide, you must ensure that you have the following requirements:

• A Linux server running Ubuntu 22.04 server - This example will be using an Ubuntu machine with the hostname 'vuls' and IP address '192.168.5.20'.
• A non-root user with sudo/root administrator privileges.
• An additional server will be used as the target machine for remote server scanning via Vuls.

With those requirements ready, you can now start installing Vuls on your Ubuntu machine.

Installing Vuls via Installer Script

Vuls is a security scanner that can be used to scan major Linux distributions, FreeBSD, cloud, on-premises, and also supports Docker. Vuls can be installed on multiple operating systems manually or using an installer script, and also can be installed with Docker.

In this section, you will install Vuls automatically to an Ubuntu 22.04 machine via the Vuls installer script.

Enter the following command to install Vuls on your machine. This will download the Vuls installer script 'install.sh' and run it on your server.

bash <( curl -s https://raw.githubusercontent.com/vulsio/vulsctl/master/install-host/install.sh )

Below is a similar output that will be printed out to your terminal.

So the Vuls installer script 'install.sh' will do the following tasks:

• Installing basic dependencies such as gcc, git, wget, curl, and sqlite3 database tool.
• Install Go the latest version manually from the binary package.
• Compiling and installing Vuls with some additional tools such as go-cti, go-kev, go-exploitdb, go-msfdb, go-cve-dictionary, goval-dictionary, and gost.

When the installation is finished, the vuls binary file and other tools will be stored in the '/usr/local/bin' directory.

Enter the following command to verify the list of binary files on the '/usr/local/bin/' directory.

ls /usr/local/bin/

You should receive an output like this - You will get the vuls binary file, go-cti, go-kev, go-exploitdb, go-msfdb, go-cve-dictionary, goval-dictionary, and gost.

With this, you have now installed Vuls on your Ubuntu machine via the installer script. In the next step, you will start configuring Vuls installation.

Configuring Vuls Vulnerability Scanner

Before using Vuls, you must define and create the configuration file for Vuls and set up the data directory that will be used to store Vuls' data.

In this section, you will set up the Vuls data directory to '/usr/share/vuls-data' and create a new Vuls configuration file 'config.toml'. You will also define multiple CVE databases and set up the first scan that can be used to scan the current local machine or server.

When running the vuls command, you must be in the working directory '/usr/share/vuls-data' where the config file 'config.toml' is located.

Enter the following command to create a new data directory '/usr/share/vuls-data' for Vuls. Then, create a new config file '/usr/share/vuls-data/config.toml' using the touch command below.

mkdir -p /usr/share/vuls-data
touch /usr/share/vuls-data/config.toml

Open the config file '/usr/share/vuls-data/config.toml' using the following nano editor command.

nano /usr/share/vuls-data/config.toml

Add the following lines to the file.

[cveDict]
type = "sqlite3"
SQLite3Path = "/usr/share/vuls-data/cve.sqlite3"

[ovalDict]
type = "sqlite3"
SQLite3Path = "/usr/share/vuls-data/oval.sqlite3"

[gost]
type = "sqlite3"
SQLite3Path = "/usr/share/vuls-data/gost.sqlite3"

[metasploit]
type = "sqlite3"
SQLite3Path = "/usr/share/vuls-data/go-msfdb.sqlite3"

[servers]

[servers.localhost]
host = "localhost"
port = "local"
scanMode = [ "fast" ]
#scanMode = ["fast", "fast-root", "deep", "offline"]

Save and close the file when you're done.

With this, you will define 4 vuls databases with the format SQLite3 which will be taken from the vuls data directory '/usr/share/vuls-data/'. The 4 databases that will be used in this example are:

• CVE (Common Vulnerabilities and Exposures).
• OVAL (Open Vulnerability and Assessment Language).
• Gost - tracks the security tracker of Linux distributions such as Rehat, Debian, Ubuntu, and the Microsoft Windows OS.
• CVEs from Metasploit-Framework modules.

You will also define the first scan called 'localhost' that allows you to scan the current local machine via SSH and the 'scanMode' or method is 'fast', which not required the root-privilege and no dependencies needed.

Next, move your working directory to '/usr/share/vuls-data/'. Whenever you run the 'vuls' command, you must be in this directory where the config file 'config.toml' is located.

cd /usr/share/vuls-data/

Enter the 'vuls' command below to verify the configuration.

vuls configtest

If successful, you should receive a similar output on your terminal screen.

At this point, you have now created the Vuls configuration, defined Vuls databases, and scan for localhost. In the next step, you will build vuls databases via multiple command-line tools provided by Vuls.

In addition, if you want to create a full Vuls configuration file, enter the following command to generate an example of Vuls configuration.

vuls discover 127.0.0.1/32

This will print out an example of Vuls configuration on your terminal.

Building Vuls CVE Databases

Within the Vuls config file 'config.toml' you have defined 4 databases using gost (Security Tracker), OVAL, CVE, and Metasploit-Framework CVEs. Before scanning any target server, you must ensure that Vuls databases are created and available on the Vuls data directory '/usr/share/vuls-data'.

In this section, you will build the Vuls database via Vuls command-line tools that you have installed and available on the '/usr/local/bin' directory. You will generate Vuls databases of Gost (Security Tracker) for the Ubuntu system, the CVE database from NVD (NIST National Vulnerability Database), the Ubuntu OVAL database, and the Metasploit-Framework CVEs database.

Each database can be generated with a specific tool that you have installed. For the basic usage of the Vuls command-line tool, you can print out the help page of Vuls tools with the following format.

vuls-command help

To start, enter the following 'gost' command to build and generate the vuls database of Security Tracker. In this example, you will generate a vuls database of security tracker for Ubuntu distribution to the target file '/usr/share/vuls-data/gost.sqlite3'.

gost fetch ubuntu --dbpath /usr/share/vuls-data/gost.sqlite3

Enter the following 'go-cve-dictionary' command to generate the vuls database for CVE. The 'go-cve-dictionary' command supports two sources of CVE providers, NVD from Nist and JVD from Japanese JVN. In this example, you will generate the CVE database from Nist to '/usr/share/vuls-data/cve.sqlite3'.

go-cve-dictionary fetch nvd --dbpath /usr/share/vuls-data/cve.sqlite3

Below is an output when all CVEs database finished.

Next, generate the vuls database of OVAL using the 'goval-dictionary' command below. OVAL provides multiple dictionaries for multiple Linux distributions and versions. In this example, you will generate an OVAL database for Ubuntu 22 to the file '/usr/share/vuls-data/oval.sqlite3'.

goval-dictionary fetch ubuntu 22 --dbpath /usr/share/vuls-data/oval.sqlite3

Lastly, enter the following 'go-msfdb' command to generate the CVE database from Metasploit-Framework modules. The vuls database file for this will be stored at '/usr/share/vuls-data/go-msfdb.sqlite3'.

go-msfdb fetch msfdb --dbpath /usr/share/vuls-data/go-msfdb.sqlite3

When vuls databases are generated, enter the following command to verify the list of vuls databases.

ls /usr/share/vuls-data/*.sqlite3

You should see Vuls databases 'gost.sqlite3', 'cve.sqlite3', 'oval.sqlite3', and 'go-msfdb.sqlite3' generated and available on the directory '/usr/share/vuls-data/'.

At this point, you have installed Vuls, configured the Vuls data directory, created the Vuls configuration file, and defined multiple vuls databases that will be used as the source database for scanning. You have also created the first scan called 'localhost' that allows you to scan the local machine that you're currently using.

In the next step, you will start scanning your local machine, then you will also create another scan that will scan the remote server with Vuls.

Scanning Local Machine with Vuls

Within the Vuls config file 'config.toml' you have created your first scan called 'localhost' that allows you to scan your current machine with Vuls. In this section, you will scan your current machine with Vuls.

Below is the first Vuls scan that you've created. This will scan the target server 'localhost' with connection type as 'local' and the 'scanMode' is 'fast', which does not require any root privileges for this.

[servers.localhost]
host = "localhost"
port = "local"
scanMode = [ "fast" ]
#scanMode = ["fast", "fast-root", "deep", "offline"]

To start, enter the following command to start scanning your system, This command will scan all target servers that are available on the config file 'config.toml'.

vuls scan

To scan a specific target server, you can use the scan name as the parameter. This will only scan the target server called 'localhost'.

vuls scan localhost

When the scanning process is finished, you should get an output similar to this - You can see that Vuls will detect the current operating systems of the target server, then start scanning the system with available vuls databases. Also, you can see the scan summary at the bottom of the output.

Next, enter the following command to view and show the detailed reports of your scan.

vuls tui

You should see 4 columns in your terminal screen, the list of target servers, the list of detected CVEs, a column that shows you the details of CVE, and the column that shows the list of affected packages. You can press the TAB button to switch from one column to others.

Lastly, press the Ctrl+C button to terminate the vuls viewer.

In addition to that, you can also track the history of scanning that you've made by typing the following 'vuls' command.

vuls history

With this, you have learned how to scan the target server using Vuls and view or show the result via the 'vuls tui' command. Next, you will learn how to scan a remote machine or server with Vuls.

Scanning Remote Server with Vuls

In this section, you will learn how to scan the remote server using Vuls via SSH. Below are the server details that will be used as the target machine:

Hostname        IP Address      OS
------------------------------------------
debian-server   192.168.5.75    Debian 11

Below are the steps of tasks for configuring Vuls and scanning the remote server via SSH:

• Install dependencies on the target server - when needed and depending on the scanMode.
• Retrieve additional CVE database for your specific system. Ensure that you have the proper Vuls database as the target server.
• Add and define target scan to the Vuls config file 'config.toml'.
• Start scanning your target server.

Now let's begin.

First, log in to the target remote server and install package dependencies 'debian-goodies' and 'reboot-notifier' using the following 'apt install' command. These packages are needed to be installed on the Debian target server.

sudo apt install debian-goodies reboot-notifier

Input y when prompted and press ENTER to proceed.

Now move to the Vuls server and retrieve a new CVE database for your specific system. In this example, you will rebuild the new database for OVAL and gost by adding the dictionary contents for the Debian Linux distribution.

Enter the following command to add new OVAL content for Debian 11 distribution to existing database '/usr/share/vuls-data/oval.sqlite3'

goval-dictionary fetch debian 11 --dbpath /usr/share/vuls-data/oval.sqlite3

Enter the following command to add a new Security Tracker for Debian distribution to the vuls gost database file '/usr/share/vuls-data/gost.sqlite3'.

gost fetch debian --dbpath /usr/share/vuls-data/gost.sqlite3

Next, open the vuls config file '/usr/share/vuls-data/config.toml' using the following nano editor command.

nano /usr/share/vuls-data/config.toml

Add the following lines to the bottom of the line. With this, you'll create a new scan called 'debian-server' with the detailed host IP address '192.168.5.75', the SSH service running on default port '22', the default user