Can arachni damaged a website?
Max
Hi,
I'm quite new using arachni and I've been told that arachni
could defaced/modified the tested website (I've been told that
arachni could put a banner "hacked by arachni" or something like
that).
I'm quite surprise because I've seen nothing about that on the
internet or on your website.
When I used arachni on personal VM I didn't see anything changed on
my website.
As I want to be careful on that topic I would like to know if it's true or not?
If it is, what configuration should I use to limit as mush as possible the damage on the scanned website?
Thank you for the answer and have a nice day :)
Comments are currently closed for this discussion. You can start a new one.
Keyboard shortcuts
Generic
| ? | Show this help |
|---|---|
| ESC | Blurs the current field |
Comment Form
| r | Focus the comment reply box |
|---|---|
| ^ + ↩ | Submit the comment |
You can use Command ⌘ instead of Control ^ on Mac
Support Staff 1 Posted by Tasos Laskos on Jun 16, 2014 @ 01:42 PM
Hi there,
It won't deface your website but as it will fuzz as many inputs as it can find, it may create a hefty amount of spam.
If, for example, you've got a comments section, it will post the associated form using a lot of different payloads.
As for generic damage, it's generally understood that you shouldn't scan production servers with any tool. Scanners are, in essence, used to discover bugs, so if you've got a bug in your web application which can, say, corrupt your DB, then it stands to reason that the scanner could trigger that behaviour.
This sort of issue lies mainly with SQL injections. Let's say you've got an SQL query to delete an entry by
idand that query can be manipulated, there could be a scenario where the injected payload could alter that query in a way that ignores theidrestriction and deletes all entries.The only way to limit the risk would be to disable a lot of the security checks, but that won't leave you with much coverage.
In general, it's best to scan a test server instead.
Does that answer your question?
Cheers
2 Posted by Max on Jun 16, 2014 @ 02:56 PM
Yeah, thank you for the answer.
That's what I was looking for.
Cheers :)
Tasos Laskos closed this discussion on Jun 16, 2014 @ 02:58 PM.