I want to scan my own website for vulnerabilities using Vega and w3af from kali linux. I assume these tools perform active attacks, not passive ones. Is this correct?
If they do perform active attacks on the site to find vulnerabilities, are the payloads malicious? E.g. can I harm the database when checking for SQL injections?
Most commercial and free web app scanner are active scanners. Both W3AF and Vega generates traffic. So they are active.
Damage due to testing for SQL Injection may depend on both App and Scanner. If your app has DROP and UPDATE queries, in case of Injection, you may lost the data even SELECT query is sent by scanner. In some SQL Exploitation tools like sqlmap allows control DROP like query generation from scanner side (--risk option). But still no grantee.
As bottom line, Take a backup of your databases and files before perform web app scan to avoid nasty surprises.
Web app vulnerability scanners typically use a combination of active and passive vulnerability detection, with the majority of the testing done actively. For example, if the scanner requests a page and it returns a cookie without the 'secure' flag that is essentially a passive test. But if the scanner is trying to find an XSS vulnerability in a parameter it is probably going to actively send several hundred different requests to test attack variations. That's why active testing is more prominent.
Some scanners can be put into passive-only mode where they crawl through the app normally or monitor you using the app to detect vulnerabilties. As you might expect, this has less impact on the app (and is less detectable) but produces fewer results.
The payloads of attacks are generally non-malicious, but some of that depends on how the app reacts to it. I've seen poorly designed web apps crash when they receive unexpected data. To test something like an XSS attack the scanner may just try to inject basic script tags with an alert to see if it works. They normally aren't going to inject a keystroke logger, fake login form, etc.
With regards to your SQL injection question they shouldn't typically use SQL commands that delete data or change configurations, but that may depend on the scanning policy you use. Some scanners have malicious or DoS policies that might be more disruptive. It's also possible that your database will have a lot of records added by the scanner even if none of the previous data was manipulated.
