How many times have you heard, "Are you doing anything right now that could [verb] our [noun]?" The answer is sometimes "Yes", always "Maybe", and hopefully "No". After a recent client call, I set up a range and hammered common web servers to figure out the impact that pentesting tools have on typical client systems. I tried to answer questions like, "Does Nuclei cause performance issues for the target?", "Is testssl.sh slowing down that Linux server?" "How many Gobuster threads does it take to max out a standard WordPress server?" In this talk, I'll discuss results from tool testing that may or may not surprise you but will definitely leave you with more evidence for your next client call.
