I am currently working on some POST GATHER modules for the Metasploit Framework the idea is that after a shell is spawned on the target, it will gather certain files from the target such as chat logs.

I am confused to whether this is illegal or not as there are hundreds of modules like this, however there is no ethical use for it other than for educational purposes or in a penetration test.

An example is this module here http://www.metasploit.com/modules/post/multi/gather/firefox_creds

*EDIT* My question is related only to development of a tool, not using it.

  • 1
    I think there's some confusion about your question here. Are you asking if your use of the tool is illegal, or if your participation in developing the tool is illegal? Ethically speaking, as long as you're not putting the tool to use (or deliberately and intentionally facilitating its distribution and use ) for unauthorized system penetration, then you should be in the clear. Laws are not always exactly aligned with reasonable ethics, though.
    – Iszi
    Commented Apr 4, 2012 at 17:44
  • I mean from the development side of things.
    – h00j
    Commented Apr 4, 2012 at 17:57
  • In Germany we have a hacker-tools law, that might outlaw this. But the interpretation of the law is still a bit unclear, and courts so far seem to have erred on the side of caution. Commented Apr 4, 2012 at 19:02

5 Answers 5


You gain unauthorized shell access, and THEN you wonder if gathering chat logs is legal? :) I guess I'm not sure what you are asking. You should already have permission to attempt to breach a computer before you even fire up Metasploit, so legality is determined long before your post modules.

From a penetration test perspective, if the client is looking for certain files or proofs from a host, then those file target are within scope. If the files you are scooping up contain clues that help you penetrate further, then they could also be in scope (as long as not specifically out-of-scope).

  • Purely from a development point of view.
    – h00j
    Commented Apr 4, 2012 at 17:56
  • My answer was for a development perspective. From a development point of view, performing the equivalent of a 'locate' and 'cat' on a system that you already have access to can't be considered illegal. In other words, I don't think that post modules are the sticky legal areas. They work when you already have unauthorized access.
    – schroeder
    Commented Apr 4, 2012 at 18:09

The tools themselves are not illegal to possess. What is illegal is attacking a computer system without authorization. For instance, it would be illegal to use these exploit toolkits to attack a system that you do not have permission to attack. However, it is legal to use these tools to attack your own system.

(This answer is based upon US law, but I would expect the law in many other countries to be similar.)

Developing tools that would only be of use to bad guys, and are of limited or no use to good guys, is of dubious ethics, at best. It may be legal, but you need to consider carefully whether it comports with your own personal ethics. Ask yourself: am I making myself part of the problem, or part of the solution?


And of course, as ever, if you have a legal question you should consult a lawyer qualified in the appropriate jurisdiction who specializes in the appropriate area of the law.

(If you can't find such a lawyer, pick any lawyer and ask them to find such a lawyer for you.)


If you are in the us dev is ok. No need to reinvent the wheel what you are describing can be cobbled together from other modules. Sounds very gray hat I would watch out because whatever you build then share you are now helping others with less ethical intents than yourself intentional or not. Also unless you are being paid and the stuff is staying in house, the way judges are handling this stuff now is the more knowledge the more responsible. Look on lexis-nexus in the past five years the lawyers are getting more for less technical cases, so the cases are dragged out in the gray areas and you will end up broke and serving ridiculous time just because you did module chain a versus b and they argue it was for a specific intent. Do not mean to sound negative but like that guy in Austin doing SMS spoofing to pump ads got his visa yanked he was making around 75K two years out of school keeping amajority of it compared to the rest of us taxpayers but no screwed up plus deep legal crap because of tools from prior jobs on his system.
Anyway be careful. Hope that helps, iceberg


Since your question regards the developer's point of view, then the answer is probably simple: it is legal. If you have a computer, you can create what you want with it, the problems could arise, as the other users explained, the moment you decide to put these tools to use. You could also create something and decide never to use it, nobody stops you from doing that :)

Of course, being no lawer, I warmly suggest you to contact one whenever you have such questions.

  • Perhaps the OP is wondering about the newer laws in the EU that talk about owning 'hacking tools'. I do not think that a post module would be classified as a 'hacking tool', but all governments are trying to wrap their collective heads around this topic.
    – schroeder
    Commented Apr 4, 2012 at 19:17
  • @schroeder I must admit that I haven't heard of this before... Commented Apr 5, 2012 at 11:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .