Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to run some security scan scripts against my companies website and exchange, could the services at break it?

share|improve this question

migrated from Sep 14 '09 at 4:04

This question came from our site for professional and enthusiast programmers.

Read the website to find out exactly what they will do. Feel free to email them as well, if you are still unsure. – silky Sep 14 '09 at 1:29

I don't like the idea of running such a script on a production server while it is required for production but am all in favour of running them at a time when users and processes should not be impacted. e.g. During my designated maintenance window. If you have such a window available to you there should be no reason not to run the script. If you don't then you certainly need to tread cautiously.

The way I see it, the more nervous you may be about running the script the more reason you have to do so. You should have confidence in your systems. It's better to have it break under controlled conditions than to have someone else do it on their terms.

Edit: Make sure you have a good backup before starting. ;)

share|improve this answer

I'd be hesitant to run a scanning script of any kind against production systems, for a couple of reasons:

  1. As Frank shared, an unexpected amount of traffic could DoS the system you're testing, causing a production failure
  2. Since you're authoring (and so expecting) a thorough vulterability scan, you may miss any legitimate attacks in the same window. Against a test system, no big deal, since you'll take the system offline as soon as the scans are done anyway. Against a production system, though, somebody could have compromised it and you'd have tons of logs to deal with.
  3. If you're not completely confident that the "tester" has your best interests in mind, who's to say that they are keeping track of what you're vulnerable to, for "later use"?

All that said, before I had a company do a scan against my servers, I'd read A LOT of reviews about them online, to make sure they're legit, and if they have the option to do a less intrusive scan first, I'd monitor the impact on the production system and "ramp up" the scanning in stages, to the more invasive scans last. That way, you won't take down your server by barraging it all at once - you'll see it coming.

share|improve this answer
For number 2, you can easily separate "legit" scans by doing egrep -v leg.itm.ate.ip log.file. As for number 3, use a qualified, licensed professional in which you sign a contract with. A business like Qualys would be great. – David Rickman Sep 14 '09 at 5:58

Depending on the amount of traffic generated, your server might be DoSed, i.e. the server breaks, though it may be throttled but inversely the amount of time taken for the scan increases as well.

Additionally, from experience, web vulnerability scanners that fuzz input (SQL injection, XSS detection) tend to have the application store them in state, i.e. the website breaks.

I'll suggest that if you want to perform a vulnerability scan, duplicate the entire website (scripts + database) and fuzz them separately.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.