AnsweredAssumed Answered

Is it needed userid and password for testing vulnerabilities in a website?

Question asked by Jorge Beteta on Jan 23, 2014
Latest reply on Jan 24, 2014 by jkent

We are a company with many applications developed by ourselves and running. An external security company is offering us to test vulnerabilities using Qualys Guard. For that, between other things, they are asking us to provide them userid and password (read-only access) for each application that are going to test.


Is that necessary? Why would they need to have userid and password of an application? What kind of authentication tests would be going to do? I suposse that, in any case, if they want to test levels of access, they would need several kind of accounts (like admin user, standard user, etc) and not just one. We think that is quite awkard to be asked for userid and password for testing vulnerabilities.