2
votes
2answers
76 views

Penetration testing's terms of agreement template

My company is going to start to provide penetration testing services pretty soon, in fact, we are just missing the legal aspects of it. I'm wondering if is there any template which states the most ...
0
votes
2answers
43 views

Content of a penetration testing authorization

Recently I conducted a penetration testing where I used the following text as authorization: Penetration testing authorization During a penetration testing is possible that: The ...
47
votes
13answers
6k views

What makes it illegal to use the information learned by exploiting a bug?

According to news reports, arrests have already been made in relation to the Heartbleed bug. It sounds like this person managed to gain access to the website's database by capturing the credentials ...
2
votes
2answers
119 views

Where is the Line? [closed]

A comment posted on one of my questions the other day raised a question in my head. I know that many site admins appreciate users reporting bugs and security holes, and as a user I appreciate people ...
98
votes
7answers
5k views

Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in production unintentionally during a pentest?

Today I experienced a situation where a person responsible for the security of a company required a pentesting company to withdraw a clause in the contract that says that: "during the pentest there ...
-3
votes
2answers
451 views

Is it illegal to test a website and report the security bugs to them? [closed]

I am doing testing on some websites and I have found some serious bugs in those sites. I am not sure if this is legal or not. Is it ever legal? How can I find out if it's legal where I live? What ...
0
votes
3answers
447 views

Penetration testing against an ignorant target - Is it legal? [closed]

I know it's a big no-no in terms of etiquette, but is it illegal in Canada to perform penetration testing against a commercial company without authorization? prompted by: ...
1
vote
1answer
2k views

Are SQL injection scans considered illegal? [closed]

I know that this thread mentions that Essentially, if you are seen to be someone who knows what you are doing, then even typing in a single-quote to a web form has been enough to be arrested ...
1
vote
3answers
1k views

Is scanning a site directory considered illegal penetration testing?

Does anyone know if using Dirbuster [link] to scan for unlisted directories and their contents is (possibly) legal in say the US?
3
votes
5answers
355 views

Laws on Programming Security Tools

I am currently working on some POST GATHER modules for the Metasploit Framework the idea is that after a shell is spawned on the target, it will gather certain files from the target such as chat logs. ...
12
votes
2answers
780 views

What are legal/ethical concerns to bear in mind, when hacking websites with open invitations?

I was reading another question which mentions a site that had a page inviting people to try to hack it, and it made me wonder. Lets assume, for the sake of this rather hypothetical question, that a ...
16
votes
6answers
8k views

At what point does “hacking” become illegal?

Hypothetical situation: before I hire a web development company I want to test their ability to design secure web apps by viewing their previous client's websites. Issue: this situation raises a big ...