Download and Run OpenVAPT

Free to download and use, for your own personal or business use, on your own Linux machines. Before you download, please read, study, understand and accept the statements below.

See It Run on Your Machine

Simulated Walkthrough Using the Built-In Demo Lab. Every line below is real OpenVAPT output, trimmed for length where marked.

you@server: ~

$ curl -fsSL https://raw.githubusercontent.com/OpenVAPT/openvapt/main/scripts/install.sh | sh

OpenVAPT installer

[while there is no Stable release, two pre-release WARNING notes are printed around this line, trimmed]

release vX.Y.Z, linux/amd64

downloading openvapt_linux_amd64 and SHA256SUMS from https://github.com/OpenVAPT/openvapt/releases/download/vX.Y.Z/

checksum verified (sha256 64 hex digits)

note: cosign is not installed, so the Sigstore signature was not checked.

installed /home/you/.local/bin/openvapt

Installed (Download Only). Nothing has been scanned. OpenVAPT checks only this machine,

read-only, and before every scan it shows the acknowledgements and waits for you to type I ACCEPT.

you@server: ~

$ sudo openvapt scan

OpenVAPT - Terms of Use and Acknowledgements, version 1.8 (2026-10-14)

Full text: https://openvapt.com/legal/eula.html

[the eight statements of what OpenVAPT is are trimmed here]

By continuing you confirm each statement below:

1. I have read, studied and understood the End User Licence Agreement, the Disclaimer, the Acceptable Use Policy, the Licence, the Teaching With OpenVAPT terms and Citing OpenVAPT.

[statements 2 to 9 are trimmed here; openvapt terms prints all of them]

10. I am at least 18 years old (or the age of majority where I live), or my parent or guardian has read these statements and accepts them for me in their own name; and where I act for an organisation, I am authorised to bind it.

If you have read, studied, understood, acknowledged, agreed to and accepted all of the above,

type I ACCEPT to continue (anything else cancels; nothing is stored): I ACCEPT

Scanning this machine with 307 checks (read-only, local only)...

Illustration: Checks by Domain

Server

HOST-SSH-001SSH Allows Direct Root LoginHigh

HOST-SSH-003SSH Permits Empty PasswordsCritical

HOST-USR-003Sudo Rules Without Password (NOPASSWD)High

HOST-KRN-001Address Space Layout Randomisation Not Fully EnabledMedium

HOST-AUD-001Audit Daemon Not Enabled at BootLow

Network

NET-DB-002Redis Authentication and Network BindingCritical

NET-SVC-001Cleartext Legacy Services ListeningHigh

NET-FW-001No Active Host FirewallMedium

NET-TLS-001Deprecated TLS 1.0 or 1.1 AcceptedMedium

Web

WEB-EXP-002Environment or Secrets File ExposedCritical

WEB-EXP-001Git Repository Exposed on the WebsiteHigh

WEB-HDR-002Missing Content Security PolicyMedium

WEB-HDR-004Missing X-Content-Type-OptionsLow

you@server: ~

$ openvapt demo --format html,md --no-sign

Demo: scanning the simulated "vulnerable" lab server (in memory, your machine is not touched).

Checks run: 307 Passed: 2 Failed: 305 Incomplete: 0 (plus 3 targets) Skipped: 0 Errors: 0

Failed by severity: Critical 14 High 71 Medium 88 Low 123

CRITICAL HOST-CTR-001 Docker API Exposed Over TCP Without TLS

CRITICAL HOST-SSH-003 SSH Permits Empty Passwords

CRITICAL NET-DB-002 Redis Authentication and Network Binding

HIGH HOST-SSH-001 SSH Allows Direct Root Login

[the other 301 failed checks are listed here, trimmed]

Reports (written only on this machine, readable only by this user):

/home/you/openvapt-demo-report-20261014-074600-3873905855/report.html

/home/you/openvapt-demo-report-20261014-074600-3873905855/report.md

Open the HTML report in any web browser, for example: xdg-open /home/you/openvapt-demo-report-20261014-074600-3873905855/report.html

openvapt: 85 finding(s) at or above high severity

$ echo $?

file:///home/you/openvapt-demo-report-20261014-074600-3873905855/report.html

OpenVAPT Self-Assessment Report

lab-vulnerable (simulated) - Ubuntu 18.04.6 LTS - 2026-10-14 02:57 UTC

Executive Summary

Result: 305 checks failed (14 Critical, 71 High, 88 Medium, 123 Low, 9 Info) and 2 passed. Critical weaknesses require immediate attention.

14Critical71High88Medium123Low2Passed

HighSSH Allows Direct Root LoginHOST-SSH-001

Why it matters: Root is the one account name every attacker knows. Allowing it over SSH turns any password guess into full control of the server, and removes the audit trail of which person used root.

Evidence, sshd: Root may log in over SSH with a password

permitrootlogin yes

Fix: In /etc/ssh/sshd_config set: PermitRootLogin no (or prohibit-password if key-based root login is truly required). Log in as a named user and use sudo. Then run: sshd -t && systemctl reload sshd

Verify: sshd -T | grep -i permitrootlogin should print 'permitrootlogin no'.

Learn: P2: SSH Security, https://openvapt.com/academy/p2.html

Evidence: secrets (passwords, keys, tokens, hashes) were redacted before writing this report.

you@server: ~

$ openvapt explain HOST-SSH-001

HOST-SSH-001 SSH Allows Direct Root Login

Domain: host Severity: high CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

What it checks:

Checks whether the SSH daemon accepts logins as root with a password.

[why it matters, how it detects, how to fix and references are trimmed here]

How to verify:

sshd -T | grep -i permitrootlogin should print 'permitrootlogin no'.

- P2: SSH Security (Practitioner, about 15 minutes)

offline: openvapt learn P2

$ openvapt learn

OpenVAPT Academy: learn vulnerability assessment from theory to application.

Free, offline, nothing stored. Also online at https://openvapt.com/academy/

Foundations

F1 Security Basics 15 min

F2 What VAPT Is, and Doing It Legally 20 min

F3 Vulnerabilities, CVE, CWE and CVSS 20 min

[22 Practitioner and 6 Applied modules are listed here, trimmed]

Read a module: openvapt learn F1

Take its quiz: openvapt learn F1 --quiz

Read It. Run It on Your Own Machine.

Free for your own use, on machines you own or control, 100% at your own risk.

Download Start the Academy

Read the Walkthrough Transcript

This is a simulated walkthrough using the built-in demo lab. It is built only from real OpenVAPT output; long output is trimmed where marked and every value is kept as printed.

Install. Run curl -fsSL https://raw.githubusercontent.com/OpenVAPT/openvapt/main/scripts/install.sh | sh (Download Only). The installer picks the most stable channel that has a release, downloads the Linux binary and SHA256SUMS, verifies the checksum, checks the Sigstore signature when cosign is installed, and installs to ~/.local/bin without root. While there is no Stable release it also prints two pre-release warnings (trimmed in the scene). It prints: "Installed (Download Only). Nothing has been scanned." To scan straight after installing, Download and Scan adds --run: curl -fsSL https://raw.githubusercontent.com/OpenVAPT/openvapt/main/scripts/install.sh | sh -s -- --run.
Accept. Run sudo openvapt scan. OpenVAPT prints the terms and ten numbered acknowledgements, then asks you to type I ACCEPT; anything else cancels and nothing is stored. It then prints "Scanning this machine with 307 checks (read-only, local only)...".
Checks. The read-only checks cover three domains: Server (for example HOST-SSH-001, HOST-USR-003, HOST-KRN-001), Network (NET-DB-002, NET-FW-001, NET-TLS-001) and Web (WEB-EXP-002, WEB-HDR-002). The terminal prints only the start line and the summary; the scene illustrates the work in between.
Summary. openvapt demo scans a simulated vulnerable lab server in memory: 307 checks run, 2 passed, 305 failed, 0 incomplete; failed by severity Critical 14, High 71, Medium 88, Low 123. It writes report.html and report.md only on this machine, lists every report path with a hint on how to open the HTML report, and exits with code 3, meaning findings at or above High severity were found.
Report. The HTML report has an executive summary, severity counts and a card for each finding. The HOST-SSH-001 card shows the evidence permitrootlogin yes, the fix (set PermitRootLogin no, then sshd -t && systemctl reload sshd), how to verify it, and the Academy module P2: SSH Security. Secrets in evidence are redacted before the report is written.
Explain and Learn. openvapt explain HOST-SSH-001 prints what the check does, why it matters, how it detects, how to fix and verify it, and its references. openvapt learn lists the offline Academy: 3 Foundations, 22 Practitioner and 6 Applied modules, each with a quiz.
Next. Download OpenVAPT or start the Academy.

By using any download or command below, you confirm that you have read, studied, understood, acknowledged, agreed to and accepted every statement in the EULA, including that you use OpenVAPT 100% at your own risk. Both ways to start are shown one after the other below.

Get OpenVAPT

Choose how to start. Download Only installs and verifies OpenVAPT and scans nothing, so you can read the code and scan later. Download and Scan does the same, then assesses this machine in the same terminal and writes every report. Both use the same installer, scripts/install.sh; read it first. If you prefer to run only code you have built yourself, build from source, which is the most transparent way.

Planning

Read the acknowledgements and terms, then preview the scan with --dry-run.

Discovery

The read-only scan of this machine, checked against known weak settings and advisories.

Reporting

HTML, JSON, SARIF and Markdown reports in a private, dated folder.

The phases follow NIST SP 800-115. This is a self-assessment, not a penetration test: there is no Attack phase and no exploit code, and it is designed to look only at the machine it runs on.

Download Only

Install and verify now, scan later when you are ready. Nothing is scanned and nothing needs root.

Download Only

curl -fsSL https://raw.githubusercontent.com/OpenVAPT/openvapt/main/scripts/install.sh | sh

What It Does

Checks the machine is Linux on amd64 or arm64.
Reads the public channel list and picks the most stable channel with a release. While there is no Stable release, it says which pre-release channel it uses and warns you.
Downloads the binary and SHA256SUMS from GitHub Releases over HTTPS only.
Refuses to install unless the SHA-256 checksum matches; also verifies the Sigstore signature when cosign is installed.
Installs openvapt to ~/.local/bin without root, and prints the next steps.

What You See

OpenVAPT installer
  release vX.Y.Z, linux/amd64
  checksum verified (sha256 64 hex digits)
  installed /home/you/.local/bin/openvapt

Installed (Download Only). Nothing has been scanned.

Where Reports Go

Nowhere yet: no scan runs. When you scan later, each scan writes a new folder ~/openvapt-reports/<UTC time>/ in the home folder of the user who runs it, unless you choose one with --out. With sudo that is the home folder sudo sets, usually root's; when sudo keeps your own home folder, the reports are given back to you.

Time and Permissions

Under a minute. No root, no account, nothing sent anywhere except the downloads from GitHub.

Scan Later, Yourself

Scan Later

openvapt scan --dry-run      # preview: lists every file, command and request, scans nothing
sudo openvapt scan          # scan this machine; reports go to a new dated folder

The scan shows the acknowledgements again and continues only when you type I ACCEPT. With sudo checks can read protected files such as /etc/shadow; without it those checks are reported as Incomplete. Add --open to open the HTML report in a desktop session.

Download the Binary Manually and Verify It

For machines without Go, or when you prefer to check every step yourself. These links are the Alpha release v0.1.0-alpha.6, the one the installer picks today, built only by GitHub Actions from a public tagged commit. It is a pre-release: it may be incomplete or wrong, so use it only on a test machine.

File	What It Is
openvapt_linux_amd64	Linux, 64-bit Intel or AMD
openvapt_linux_arm64	Linux, 64-bit ARM
SHA256SUMS	SHA-256 checksums of every file
openvapt_linux_amd64.sigstore.json	Sigstore signature bundle, amd64
openvapt_linux_arm64.sigstore.json	Sigstore signature bundle, arm64

Manual Download and Verification

# Alpha v0.1.0-alpha.6, for amd64 (use arm64 on 64-bit ARM)
curl -fsSLO https://github.com/OpenVAPT/openvapt/releases/download/v0.1.0-alpha.6/openvapt_linux_amd64
curl -fsSLO https://github.com/OpenVAPT/openvapt/releases/download/v0.1.0-alpha.6/SHA256SUMS
curl -fsSLO https://github.com/OpenVAPT/openvapt/releases/download/v0.1.0-alpha.6/openvapt_linux_amd64.sigstore.json
sha256sum -c SHA256SUMS --ignore-missing      # must print: openvapt_linux_amd64: OK
cosign verify-blob --certificate-identity-regexp '^https://github\.com/OpenVAPT/openvapt/\.github/workflows/release\.yml@refs/heads/main$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --bundle openvapt_linux_amd64.sigstore.json openvapt_linux_amd64
install -m 0755 openvapt_linux_amd64 ~/.local/bin/openvapt
openvapt version

Also confirm the build provenance with gh attestation verify openvapt_linux_amd64 --repo OpenVAPT/openvapt --signer-workflow OpenVAPT/openvapt/.github/workflows/release.yml. Each release also carries a source archive and an SBOM.

Download and Scan

Install, verify and assess this machine in one go, with every report written for you. Run it in a terminal on the machine itself: the scan needs you to type I ACCEPT.

Download and Scan

curl -fsSL https://raw.githubusercontent.com/OpenVAPT/openvapt/main/scripts/install.sh | sh -s -- --run

What It Does

Everything Download Only does: picks the release, verifies the checksum (and the signature with cosign) and installs without root.
Starts a read-only scan of this machine only. Every connection stays on 127.0.0.1.
The scan shows the acknowledgements and waits for you to type I ACCEPT on the terminal, even when the installer is piped. The installer never answers for you; with no terminal it refuses to scan.
Writes all four reports, signed with your local key: report.html, report.json, report.sarif and report.md.
Prints the severity summary, the exit code and what it means, every report path, and how to open the HTML report.

What You See

type I ACCEPT to continue (anything else cancels; nothing is stored): I ACCEPT
Scanning this machine with N checks (read-only, local only)...
Scan finished.
Summary: Critical n, High n, Medium n, Low n, ...
Exit code 3: findings at or above High severity were found
Reports (only on this machine, readable only by you):
  /home/you/openvapt-reports/20261014T074600Z/report.html

Where Reports Go

A new folder ~/openvapt-reports/<UTC time>/, readable only by you (mode 0700). It is never reused or written over. Choose another new folder with --out DIR.

Time and Permissions

Usually one to five minutes. By default the scan runs as you, so checks that need protected files are reported as Incomplete. For full coverage add --sudo: only the scan runs with sudo (it may ask for your password), the install does not, and the reports are given back to you.

Full Coverage

Download and Scan With Full Coverage (sudo for the Scan Only)

curl -fsSL https://raw.githubusercontent.com/OpenVAPT/openvapt/main/scripts/install.sh | sh -s -- --run --sudo

More options: --open opens the HTML report with xdg-open, only in a desktop session; --dry-run installs and then previews every file, command and request a scan would use, without scanning. Exit codes: 0 completed with nothing at or above High, 3 findings at or above High, 4 incomplete coverage, 5 error or cancelled, 6 the report could not be written.

Release Channels

Without --channel the installer uses the most stable channel that has a release. To test a specific pre-release on a test machine, add --channel; a channel with no release stops with a clear message. Current builds per release channel:

Channel	Current Build	Install Option
Stable	Not Released Yet	--channel stable
Release Candidate	Not Released Yet	--channel rc
Beta	Not Released Yet	--channel beta
Alpha	v0.1.0-alpha.6	--channel alpha

curl -fsSL https://raw.githubusercontent.com/OpenVAPT/openvapt/main/scripts/install.sh | sh -s -- --channel beta

The installer downloads only over HTTPS with TLS 1.2 or newer, including redirects. When cosign is missing it continues with the checksum alone; to refuse installation unless the Sigstore signature is verified, set OPENVAPT_REQUIRE_SIGNATURE=1. Piping a script into a shell trusts whoever serves it; if you prefer, download it, read it, then run it:

curl -fsSL https://raw.githubusercontent.com/OpenVAPT/openvapt/main/scripts/install.sh | OPENVAPT_REQUIRE_SIGNATURE=1 sh

curl -fsSLo install.sh https://raw.githubusercontent.com/OpenVAPT/openvapt/main/scripts/install.sh
less install.sh
sh install.sh          # Download Only
sh install.sh --run    # Download and Scan

Build From Source (Most Transparent)

You run exactly the code you can read, it needs nothing but Go, and building it is part of learning how it works. You need Go 1.26 or newer; go.mod pins the Go 1.26.9 toolchain and Go downloads it automatically if needed.

# 1. Get the source
git clone https://github.com/OpenVAPT/openvapt.git
cd openvapt

# 2. Read it (start with README.md, internal/scope and internal/sys)

# 3. Run the tests, including the simulated lab tests
go test ./...

# 4. Build a single static binary
CGO_ENABLED=0 go build -trimpath -o openvapt ./cmd/openvapt

# 5. Read the acknowledgements again, then check the version
./openvapt terms
./openvapt version

To build exactly a released version, check out its tag first, for example git checkout v0.1.0-alpha.6 (the newest released build; see Release Channels for every channel). To build the same bytes as the official release binary, use the same Go version and flags as the release (shown in its release notes and in the Makefile):

git checkout v0.1.0-alpha.6
make release VERSION=v0.1.0-alpha.6
sha256sum dist/release/openvapt_linux_amd64   # compare with the published SHA256SUMS

Try It Safely First

openvapt demo                    # scans a simulated vulnerable server, in memory
openvapt scan --dry-run          # lists every file, command and request a real scan would use
openvapt learn                   # the OpenVAPT Academy, offline
openvapt explain HOST-SSH-001    # documentation for one check

Scan Your Own Linux Machine

sudo openvapt scan

Before every scan the tool shows the acknowledgements again and continues only when you type I ACCEPT (or you pass --accept-terms for automation, which counts as the same acceptance). Running as root lets checks read protected files such as /etc/shadow; without root those checks are skipped or marked Incomplete. Reports go to a new private folder ~/openvapt-reports/<UTC time>/ in the home folder of the user running the scan, or to the folder you name with --out. With sudo that is the home folder sudo sets, usually root's; when sudo keeps your own home folder, the reports are given back to you. After the scan OpenVAPT lists every report file and how to open the HTML report. Exit codes: 0 success, 2 invalid arguments, 3 Critical or High findings, 4 incomplete coverage, 5 scan errors, 6 report write failure.

Cite OpenVAPT

If OpenVAPT helps your coursework, thesis, paper or project, please cite the version you used (openvapt version). Copy a ready-made reference from How to Cite OpenVAPT, or read Citing OpenVAPT. openvapt cite prints the citation for your exact build.

Uninstall

OpenVAPT installs nothing beyond its own binary. Delete the binary (rm ~/.local/bin/openvapt if you used the installer) and your report folders (~/openvapt-reports). If you signed reports, also delete ~/.config/openvapt/report-key.

Cite This Work: OpenVAPT. (2026). OpenVAPT: An open academic vulnerability assessment tool (Version 0.1.0-alpha.6) [Computer software]. https://github.com/OpenVAPT/openvapt

Download and Run OpenVAPT

See It Run on Your Machine

Before You Download

Get OpenVAPT

Download Only

Download and Scan

Release Channels

Build From Source (Most Transparent)

Try It Safely First

Scan Your Own Linux Machine

Cite OpenVAPT

Uninstall