Can a vulnerability scanning script break my servers?

Question

I want to run some security scan scripts against my companies website and exchange, could the services at http://www.hackertarget.com break it?

Answer 1

I don't like the idea of running such a script on a production server while it is required for production but am all in favour of running them at a time when users and processes should not be impacted. e.g. During my designated maintenance window. If you have such a window available to you there should be no reason not to run the script. If you don't then you certainly need to tread cautiously.

The way I see it, the more nervous you may be about running the script the more reason you have to do so. You should have confidence in your systems. It's better to have it break under controlled conditions than to have someone else do it on their terms.

Edit: Make sure you have a good backup before starting. ;)

Answer 2

I'd be hesitant to run a scanning script of any kind against production systems, for a couple of reasons:

1. As Frank shared, an unexpected amount of traffic could DoS the system you're testing, causing a production failure
2. Since you're authoring (and so expecting) a thorough vulterability scan, you may miss any legitimate attacks in the same window. Against a test system, no big deal, since you'll take the system offline as soon as the scans are done anyway. Against a production system, though, somebody could have compromised it and you'd have tons of logs to deal with.
3. If you're not completely confident that the "tester" has your best interests in mind, who's to say that they are keeping track of what you're vulnerable to, for "later use"?

All that said, before I had a company do a scan against my servers, I'd read A LOT of reviews about them online, to make sure they're legit, and if they have the option to do a less intrusive scan first, I'd monitor the impact on the production system and "ramp up" the scanning in stages, to the more invasive scans last. That way, you won't take down your server by barraging it all at once - you'll see it coming.

Answer 3

Depending on the amount of traffic generated, your server might be DoSed, i.e. the server breaks, though it may be throttled but inversely the amount of time taken for the scan increases as well.

Additionally, from experience, web vulnerability scanners that fuzz input (SQL injection, XSS detection) tend to have the application store them in state, i.e. the website breaks.

I'll suggest that if you want to perform a vulnerability scan, duplicate the entire website (scripts + database) and fuzz them separately.