Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As a hobby, I find security holes ranging from XSS to SQLi to LFI etc in random websites I find. (I don't exploit them). I've decided to to do a little more; I want to create a volunteer group composed of hackers who will find holes and report them to the website.

I'm finding two "issues":

  • Although I don't exploit the holes, could I get in legal trouble for reporting the hole to the website?
  • Where could I find fellow non-malicious hackers?

The group would be entirely volunteer based and would be completely non-malicious.We would not take on clients or do tests on request. Sites would be entirely random; no specific sites would be targeted and the test would be conducted without the site's consent or knowledge. If a hole is found, the site is notified. If not, we would move on.

Should I be concerned about anything else?

I apologize if this is the wrong site to ask, but I have no idea where to go...

share|improve this question
I'm not a lawyer or a professional in the security field, but I imagine that that's a very bad idea. Don't forget that legal problems don't only carry the chance of punishment. Even a lawsuit in which your found non-liable can be expensive. Also, I don't think you could find 'hackers' you trust enough. A single bad act could bring rather bad attention to the entire group. – Corbin Apr 7 '12 at 5:05
Simple, don't notify them, you could be breaking the law. – rook Apr 7 '12 at 7:35
Send an email to the webmaster from an anonymous email address, on a computer that you do not generally use. Make sure that the email provider does not log IP addresses – alexy13 Feb 6 '13 at 21:16
up vote 3 down vote accepted

You could read the latest IT Security's blog post which talks about a similar topic. It's a interesting read and you might find some answers, even if your scenario and the one they are analyzing are a bit different.

The point is, there are many possible consequences to bear in mind when hacking a website that requests to be hacked, if you want to hack a website that doesn't request to be hacked and then notify them, you should probably be even more careful.

Of course, I am no lawyer, so for any more specific questions I suggest you to talk to one.

share|improve this answer
Yeah, I also figured I should talk to a laywer, but I can't afford one... Any free/volunteer lawyers? – citruspi Apr 7 '12 at 13:21
@MihirSingh a fast Google query return this link, maybe you could find it useful: – user1301428 Apr 7 '12 at 16:55
submitted a question... thanks. crossing my fingers now :) – citruspi Apr 7 '12 at 17:15
@MihirSingh you're welcome :) – user1301428 Apr 7 '12 at 17:16
@MihirSingh oh I forgot, accepting means clicking on the checkmark below the arrows on the left of the answer. I'm telling you this because I see that many users miss that. – user1301428 Apr 8 '12 at 8:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.