Why is it better for a security tester to take a copy of a server e.g. eBay server and test it on a virtual machine rather than on than the real eBay server?

E.g. doing security testing on the live server can cause damage and cause the eBay services to be unavailable. (e.g. SQL injection attacks can erase the eBay database)

Why does a virtual machine prevent major security risks or any risk like these?

closed as unclear what you're asking by schroeder Dec 4 '18 at 10:57

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • this is a duplicate of your other question and has the same lack of clarity – schroeder Dec 4 '18 at 11:00
  • I created this before after I change the title of another one and no reply Yesterday. – Darkshow Rider Dec 4 '18 at 11:09

The advantage of a virtual machine is that it's what it is, virtual. Assuming you're testing against a real server (be it a development or production one), you run the risk of losing data by poking at the wrong stuff, and have some downtime, meaning lost customers and revenue.

Another thing is that virtual machines can easily be save-stated, duplicated, and then are extremely valuable testing tools. If you find a vulnerability, you can have a VM that's in the state where the vulnerability can be exploited, you can then save that state, and reproduce it far easier at a later time to get more insight.

Overall : Using a VM eliminates the risk of downtime due to pentest, and allows an easier reproduction of the found exploits without compromising data

  • Honestly, I don't agree. Any customer should be made aware of the implications of a pentest before singing the permission to attack. Also, depending on the scope, testing a virtual copy of a server may lead to unreliable results (lateral movement?) and testing should in general be done in an env. as close to prod as possible. And what good is a pentest if you do not discover that a simple attack might lead to a DoS? – SeeYouInDisneyland Dec 4 '18 at 8:22
  • Depends on the type of tests you do. But I assume no test is worth getting your main website (using eBay as an example) down for any amount of time, this would both heavily reduce the company's income, and hurt their image. – Elcan Dec 4 '18 at 9:50
  • @SeeYouInDisneyland It is precisely because there are "implications of a pentest" that (at least initial) testing might be done on a VM. Once you have completed that (and, if necessary, fixed anything found), then you might repeat the test on the "real thing", knowing it probably should survive. – TripeHound Dec 4 '18 at 15:00
  • A website of any size (like ebay) is going to be running in High Availability...taking down one web server (or one of anything for that matter) should not take down the site. – DarkMatter Dec 4 '18 at 15:01
  • DarkMatter, that's a matter of the potential exploit. Some DOS attacks are able to create a cascading effect even for HA systems. Heck, the fact that Amazon, Ebay, Youtube...etc can go down at all shows the weaknesses in HA systems for just day to day activities, let alone an intentional attack. – Jarrod Christman Dec 13 '18 at 14:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.