Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What are the limitations of vulnerability scanners?

If it is related to how these scanners work, how these work?

share|improve this question
Related: Why Johnny Can't Pentest – Gurzo Apr 27 '12 at 10:51

Their limitation is that their false negative and in particular their false positive rates are higher than skilled humans doing the same task.

Their big advantage is that they can cover large suites of known vulnerabilities and crawl entire websites much, much faster than humans can.

Two examples: I once saw a web application scanner flag up a file it found for containing a local IP address which could be an information leak. I verified that it wasn't but I also spotted in the same file a key/value pair of dbpass: bigsecret. A vulnerability scanner has no way of doing either of these things.

Another scan found what it said was an SQL injection. It wasn't but it was echoing out the payload to the page. With sone fiddling around, I turned that into an XSS exploit that the rest of the scan didn't find.

Lots of scanners keep lists of version numbers of software that are known to contain vulnerabilities. However, most Linux distros backport security fixes into older but still supported software without changing the features or the version number. (They usually append something to the version string.). This causes false positives.

The above method is safer than actually trying to exploit flaws. To try and keep the false positives down, some scanners create "safe" ways to exploit vulnerabilities. Others include "fuzzing" which sends random or semi-random data at the service in the hopes of making it break. In both cases, scanners can easily miss the signs of an exploitable hole that a skilled human would see.

Lastly, sometimes even XSS isn't "safe" and there is no feedback for the scanner to detect. I scanned what the client promised was a demo system, not connected to production, but it turned out that the "Contact support" form was live and actually went to support. After their main screen was filled with 10,000 popups containing variations of "Found an XSS in form parameter 'subject'!" they called me and asked me to stop the scan.

share|improve this answer

I have done a few minor vulnerability assessment with Nessus. Some of the limitations that I can think of is that it's based on known vulnerabilities. Secondly, it does not work with any custom applications.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.