Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know that this thread mentions that

Essentially, if you are seen to be someone who knows what you are doing, then even typing in a single-quote to a web form has been enough to be arrested and charged over in the past.

But lets say i'm writing a pen test tool that will be doing sqli testing and let it loose on sites that are 'out in the wild'. I'm not going to be doing dumps of any information. But is just the vulnerability scan itself illegal?

share|improve this question

closed as off topic by Scott Pack, D.W., Iszi, AviD Aug 18 '12 at 20:32

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

While we, as security professionals, do often have to deal closely with legal issues, we're not here to serve up legal advice. This kind of question in particular is highly localized since it depends exclusively on jurisdictional boundaries. – Scott Pack Aug 8 '12 at 20:17
Instead of worrying about legality, just make sure you don't get caught. Use Tor and make sure you hide all your unique browser identifiers or use a proxy that removes them (Privoxy I think). I think it's all in one package now if you download Tor bundle. – Matrix Aug 9 '12 at 6:55
Geez. Don't listen to Matrix. One of the hallmarks of a real security professional is a high ethical and moral standard. You must consider if you "should" more than you consider if you "can." – queso Aug 9 '12 at 21:29
up vote 7 down vote accepted

It will depend on the legal system under which it falls. But you are still doing something hostile. Without previous written permission of the siteowner, you are committing a crime.

There is no way of proving you didn't have a malicious intent. Intent is the key component here. A ping can be done to see if your own internet connection is working or if a website might be down because of a failing server. But if your intent is the see if a site/server is vulnerable for a ping fload, then you are possible already committing a felony.

It will be up for a judge to decide, but consider this:

If you would be trying all the doors of a random car in the street to see it's properly locked and someone sees that, would they believe you were just trying to see if it's locked?

share|improve this answer
Would a 'ping' fall under the "trying the door handles" situation? – Digital Fire Aug 8 '12 at 20:00
Like I said that's up for a judge to decide. With a vulnerability scan you are going way further than just one ping. – Lucas Kauffman Aug 8 '12 at 20:01
We are getting into a discussion, which is more approriate for the chat. But like I said, that's up for a JUDGE TO DECIDE. – Lucas Kauffman Aug 8 '12 at 20:03
Plus if your intent is the see if the site is vulnerable, that would be considered hostile. – Lucas Kauffman Aug 8 '12 at 20:04
In France for example, not allowed access, or maintained presence in an Information System is considered illegal. Trying to do that is considered to be as illegal as actually doing it. – M'vy Aug 8 '12 at 20:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.