Is there a standard way of automatically testing the basic security of my web server? I've found a couple on-line services, (e.g. http://hackertarget.com/), and they seem ok, but I'd like to start off with the basics. Is there a go-to method for stress-testing a web server's security?


There are a number of scanners out there which aren't free. Like Nexpose or Nessus which can do way more than just scanning a webserver. But they provide this functionality as well of course.

The interesting part is that these scanners can also log into your server and perform configuration reviews to a certain standard. For instance the DISA STIG is a very good baseline to test against and see if you have properly implemented your webserver in a secure way.

Aside from that, you can also test the application itself, with automated scanners like Burp or Appscan.

Another option would be to use ASV. They are normally only used for PCI-DSS compliance, but you can also use them of course even if you needn't be compliant with PCI-DSS. Their baseline scans and reports are a very good baseline assessment to see what the level of security is, as the PCI-DSS requirements are not light at all.

| improve this answer | |
  • 1
    There is a Nessus Home edition. – Gumbo Dec 1 '14 at 11:17
  • @Gumbo true, but it can't be used for commercial purposes though. Although the OP didn't specify this. – Lucas Kauffman Dec 1 '14 at 12:15
  • There is OpenVAS which is an open source fork of Nessus. – Gene Gotimer Dec 1 '14 at 14:38
  • 1
    yea but that's what his current solution is using. – Lucas Kauffman Dec 1 '14 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.