Barracuda Vulnerability Manager
The shortest path to protecting your web applications.
Identify and fix website vulnerabilities — before hackers exploit them.
Vulnerabilities in your websites and other public-facing applications can lead to costly data breaches that disrupt your business operations and erode customer trust. There are hundreds of ways to bring down a website, hack into your data, and introduce malware into your network. In fact, more than 80 percent of websites have vulnerabilities that put businesses and data at risk.
Don’t wait until it’s too late. Barracuda Vulnerability Manager is a free service that scans sites and applications in a single click. Just enter your website URL, and you’ll soon receive a report detailing all discovered vulnerabilities. You can then address the issues yourself, or you can load the report into a Barracuda Web Application Firewall solution and use the Vulnerability Remediation Service to automatically remediate them.
76%: Percentage of US businesses have experienced a cyberattack in the past year 1*
$3.92 million: Average cost of a data breach 2*
279 days: Average time to identify and contain a breach 2*
1* 76 percent of US businesses have experienced a cyberattack in the past year
2* IBM Study Shows Data Breach Costs on the Rise; Financial Impact Felt for Years
Don’t let DDoS attacks bring your business to its knees.
The Barracuda Vulnerability Manager is able to detect a wide variety of application security flaws, including all OWASP Top 10 vulnerabilities (HTML Injection, SQL Injection, Cross-Site Scripting, and Cross-Site Request Forgery), and many others, such as leakage of sensitive data.
It’s a non-invasive, cloud-based tool, with no impact on your operations. Use it as often as you like, at no cost. The detailed output of the scan lists all vulnerabilities discovered, ranks them from most to least critical, and provides additional insights to help you address them.
Stay protected with Barracuda WAF solutions.
Barracuda Vulnerability Remediation Service is available as a feature of any Barracuda WAF solution. It builds on the detection technology of the Vulnerability Manager, and lets you automatically fix web application vulnerabilities with just a few clicks. By eliminating costly, time-consuming, and error-prone manual security audits, the Vulnerability Remediation Service accelerates and streamlines your application development cycles. You can easily configure it to run automatic and on-demand scans when new code is developed, automating your security processes and ensuring ongoing protection against newly discovered vulnerabilities.
Protect websites and applications from cyber-threats
Protect every web app, hosted anywhere, in minutes
Eliminate vulnerabilities and support compliance with a single click.
If you own a Barracuda WAF solution, it can use your free vulnerability report as a configuration tool, making web application security a completely automated process. Detailed reporting of vulnerabilities discovered and remediated helps you document regulatory and policy compliance.
Barracuda WAF solutions include WAF-as-a-Service, CloudGen WAF (available in the AWS and Azure Marketplaces), and Web Application Firewall (on-premises hardware and virtual appliances).
Frequently Asked Questions
What does Barracuda Vulnerability Manager scan?
Barracuda Vulnerability Manager scans web applications only, so it will only target the web server it is pointed at. It does not scan your network or infrastructure. For example, Vulnerability Manager will not target or scan layer 3 firewalls, VPN devices, email servers or devices, FTP servers, phone systems, or any other network devices.
What types of vulnerabilities does Barracuda Vulnerability Manager detect?
Barracuda Vulnerability Manager detects many common web application vulnerabilities, including SQL Injection, Cross-Site Scripting (XSS), CrossSite Request Forgery (CSRF), and others.
Where are the scans performed from?
Barracuda Vulnerability Manager scans are performed from Barracuda’s data center in Southfield, Michigan. The IP range is 64.235.153.0/24
How is the scan performed?
In order to scan the web application, Barracuda Vulnerability Manager will send specially crafted requests to your web server and analyze the responses. Vulnerable servers will respond in ways that the scanner can detect, and we will report this to you. The requests Barracuda Vulnerability Manager sends are specially designed not to cause any damage to your servers—they will only detect vulnerabilities, not exploit them in any way.
What data does Barracuda Vulnerability Manager collect during the scan?
During the scan, Barracuda Vulnerability Manager collects various information about your application; this information is used to increase accuracy and find vulnerabilities in the application. This information may include data on the technologies and components in use by your application, the structure of your application, as well as lists of pages, forms, fields, and cookies.
Barracuda Vulnerability Manager does not collect any personally identifiable information (PII) or records from your application’s database, whether this information is publicly accessible or not. If Barracuda Vulnerability Manager finds a vulnerability that could compromise confidentiality of data on your web application, it does not collect any of the data that could be compromised; instead, it only alerts you to the problem.
Barracuda Vulnerability Manager also does not collect the source code (whether client-side or server-side) of your application.
How long does a scan take?
The length of the scan varies widely with the size of your application—from a few minutes up to multiple days. You can monitor the progress of the scan from Barracuda Vulnerability Manager’s Active Scans screen. If you like, you can also limit the length of the scan; in this case, you will only see the vulnerabilities that were found within this period of time. You can always cancel a currently running scan; again, you will only see the vulnerabilities found until it was canceled.
What are the risks of running the scan?
The scan is specially engineered not to cause damage to your web application, web server, database, or network infrastructure. During the scan process, the scanner submits all web forms found on your application a large number of times in order to test for vulnerabilities. If you have unprotected forms that write data to a database or send emails based on form submissions, you may see a large number of database records or emails sent during the scan. You can safely ignore or delete these records and/or emails; they do not cause any damage.
Will the scan overload my web server?
Barracuda Vulnerability Manager has an automatic overload protection feature: If it detects high load on your web server, it will automatically reduce the scan speed until high load is no longer detected. Regardless of overload protection, Barracuda Vulnerability Manager sends a maximum of 15 requests per second to your server. If you wish, you may adjust this number on the Crawling tab of the scan configuration dialog. For example, you may want to increase this number if you are scanning a non-production server and want the scan to complete faster.
Can I scan applications hosted on public cloud servers, on-premises, collocated, etc.?
Barracuda Vulnerability Manager can scan any web application that is publicly accessible, regardless of where it is hosted. If any user on the internet can enter your application’s URL and access it, it can be scanned.
Can I scan applications that are behind a load balancer or firewall?
Yes. Barracuda Vulnerability Manager can scan regardless of any load balancers or firewalls in front of the application, as long as the application is publicly accessible.
Will Barracuda Vulnerability Manager “hack” my application in order to detect vulnerabilities?
No. Barracuda Vulnerability Manager will determine if your application could be hacked by a malicious attacker, but it will not hack your application. In particular, Barracuda Vulnerability Manager will not cause your application to execute any harmful code, steal data from your application, or cause it to crash.
Will Barracuda employees have access to my application’s data?
No. While Barracuda Vulnerability Manager may store request and response data to help you locate vulnerabilities, your application’s data will not be stored on Barracuda servers or accessible to Barracuda employees.
Are scan reports stored in Barracuda’s cloud? How can you ensure the reports remain confidential?
Scan reports are stored on specially designated servers in Barracuda’s dedicated data center. Only you can access your reports using your Barracuda Cloud Control credentials. If you have regulatory requirements that your data be kept on physically separate servers, or onpremises, please contact us to discuss on-premises options.
Can anyone with access to Barracuda Vulnerability Manager scan my application?
No. For security reasons and to prevent abuse, users must verify every domain they intend to scan, either through the Cloud Control domain verification process or through Barracuda Vulnerability Manager itself. Users will be prompted to perform this verification process, which is easy and just requires clicking a link in an email.
Barracuda Vulnerability Manager found a vulnerability on my application. What should I do?
You should take immediate action to remediate vulnerabilities found by Barracuda Vulnerability Manager, especially those with High or Critical severity levels.
The easiest way to remediate web application vulnerabilities is to use a Barracuda Web Application Firewall (WAF). Barracuda’s WAF can import the results of a Barracuda Vulnerability Manager scan and automatically remediate all the vulnerabilities found by the scan.
The information provided in Barracuda Vulnerability Manager’s report can also be used by your web application’s developers to find and fix the problem manually in the application’s source code.