4 ms·

I'm always slightly dubious of full automated penetration testing tools, particulary ones that state things like "It is non-intrusive, with no impact on your n

I'm always slightly dubious of full automated penetration testing tools, particulary ones that state things like "It is non-intrusive, with no impact on your network." (from https://www.guardicore.com/infectionmonkey/ https://www.guardicore.com/infectionmonkey/) Having a quick look at the site some of the modules it can use are brute-force password guessers which could cause account lockouts quite easily, depending on how they're used. Also in my moderately long experience of pentesting (~15 years) even quite innocuous seeming actions can negatively impact systems under review (I've knocked over whole networks with standard port scanning, taken out a website with a ' character in a login box, seen another website taken out by being spidered etc) This isn't to knock this tool in particular, just expressing a general wariness of tooling which claims to be able to fully automate a process and do so with zero risk.

corty 6y ago
Agreed, testing is never without risk. The risk however is smaller than the one presented by an attacker in such a scenario. If you are running such a house of cards, you need to know now. Avoiding toppling it over in pentesting just leads to more problems being overlooked. Customers in this case need to realize that some pain is in their best interest. If the dentist cannot drill, he cannot help.
- raesene9 6y ago
  As a pentester, you may be surprised at how many companies do not see things that way :) Of course, everyone should have a robust environment which can withstand any testing. However, particular where a tool like this is intended to run constantly in an environment, I think the Ops teams would want to know whether there was a risk of an outage due to its use.