Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Does anyone know if using Dirbuster [link] to scan for unlisted directories and their contents is (possibly) legal in say the US?

share|improve this question
add comment

3 Answers

up vote 6 down vote accepted

If you don't have permission to perform security testing against a target, don't do it.

In the US, you are definitely at risk of falling foul of the The Computer Fraud and Abuse Act 1986, 1994, 1996 and possibly other acts. It's easy enough to set up a test target of your own, ask a friend for permission to test their site, or use a service such as Webgoat or Gruyere.

Essentially, if you are seen to be someone who knows what you are doing, then even typing in a single-quote to a web form has been enough to be arrested and charged over in the past.

No permission, no pen testing. It's simple. Why risk it.

share|improve this answer
    
To be honest I'm curious about a site in the making, and I kinda wanted to take a sneak peek seen as the directories are fully unprotected. xD I could just hide myself behind proxies but I think I'll do the right thing and pass. =) –  Happy May 15 '12 at 17:30
1  
@Happy, judges don't tend to treat "I was just curious" as extenuating circumstances. –  Mike Samuel May 15 '12 at 18:52
add comment

I'm with @Cheekysoft, basically using any knowledge over and above point and click is ilegal unless youve got it in writing from the legal owners of the target/client systems. It's meant to be vague as technology moves infinitely faster than legislation.

share|improve this answer
    
in fact i'm almost 100% certain that anyone working in technology except the cleaning ladies are technically criminals –  Alex May 17 '12 at 23:11
    
awesome comment Alex xD –  Happy May 19 '12 at 0:24
add comment

You should only test on software you own or have written consent to test on. If you wan't to "play" and test there are a lot of options. One such good one is the DVWA . Here is even a script to get the entire thing up and running in a few clicks.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.