Hypothetical situation: before I hire a web development company I want to test their ability to design secure web apps by viewing their previous client's websites.
Issue: this situation raises a big red flag: with regards to viewing a website, what is and is not within the breadth of the law? Or in other words: at what point does poking around a website become illegal?
- View Source with Firebug? Naturally that would be legal.
- But what if I change HTML (like a hidden form value before submission)?
- What if I put %3Cscript%3Ealert(1)%3C/script%3E at the end of the URL.
- Or perhaps I type the URL: example.com/scripts/ and I'm able to view their directory due to faulty permission settings?
- What if I manipulate data passed in HTTP headers, for instance a negative product qty/price to see if they do server side validation (naturally, I wont complete the checkout).
To me, all of this seems perfectly harmless because:
- I'm not causing undue stress to their server by spamming, mirroring the site with wget, or injecting potentially dangerous SQL.
- I'm not causing any potential loss or monetary damages, because I wont ever exploit the vulnerabilities, only test for their existence (proof of concept).
- None of my actions will have any implication for user data privacy. In no way would any of my actions potentially reveal confidential or private information about anyone.
- If I did find anything I would immediately notify the webmaster of the potential exploit so they could patch it.
But even though I am logically able to justify my reasons for testing the site, that does not necessarily make my actions legal. In fact, cyber laws are notoriously backwards in the United States, and even the most laughably trivial actions can be considered hacking.
Questions: Is there a defined line in the sand that separates illegal hacking from "testing without permission"? Or is this whole scenario a grey area that I should avoid (likely the case). Are there any linkable online resources that could expand my knowledge in this wholly grey area? What are the specific acts or laws that handle this?
Please keep in mind that the number one most logical choice would be to simply: ask for permissions. However, due to heavy time constraints, by the time I would get permission it would all be for naught.