5

As a hobby, I find security holes ranging from XSS to SQLi to LFI etc in random websites I find. (I don't exploit them). I've decided to to do a little more; I want to create a volunteer group composed of hackers who will find holes and report them to the website.

I'm finding two "issues":

  • Although I don't exploit the holes, could I get in legal trouble for reporting the hole to the website?
  • Where could I find fellow non-malicious hackers?

The group would be entirely volunteer based and would be completely non-malicious.We would not take on clients or do tests on request. Sites would be entirely random; no specific sites would be targeted and the test would be conducted without the site's consent or knowledge. If a hole is found, the site is notified. If not, we would move on.

Should I be concerned about anything else?

I apologize if this is the wrong site to ask, but I have no idea where to go...

Improve this question
3
  • I'm not a lawyer or a professional in the security field, but I imagine that that's a very bad idea. Don't forget that legal problems don't only carry the chance of punishment. Even a lawsuit in which your found non-liable can be expensive. Also, I don't think you could find 'hackers' you trust enough. A single bad act could bring rather bad attention to the entire group.
    – Corbin
    Apr 7, 2012 at 5:05
  • 1
    Simple, don't notify them, you could be breaking the law.
    – rook
    Apr 7, 2012 at 7:35
  • Send an email to the webmaster from an anonymous email address, on a computer that you do not generally use. Make sure that the email provider does not log IP addresses
    – alexyorke
    Feb 6, 2013 at 21:16

1 Answer 1

Reset to default
3

You could read the latest IT Security's blog post which talks about a similar topic. It's a interesting read and you might find some answers, even if your scenario and the one they are analyzing are a bit different.

The point is, there are many possible consequences to bear in mind when hacking a website that requests to be hacked, if you want to hack a website that doesn't request to be hacked and then notify them, you should probably be even more careful.

Of course, I am no lawyer, so for any more specific questions I suggest you to talk to one.

Improve this answer
6
  • 1
    Yeah, I also figured I should talk to a laywer, but I can't afford one... Any free/volunteer lawyers?
    – citruspi
    Apr 7, 2012 at 13:21
  • @MihirSingh a fast Google query return this link, maybe you could find it useful: freeadvice.com
    – user1301428
    Apr 7, 2012 at 16:55
  • submitted a question... thanks. crossing my fingers now :)
    – citruspi
    Apr 7, 2012 at 17:15
  • @MihirSingh you're welcome :)
    – user1301428
    Apr 7, 2012 at 17:16
  • 2
    @MihirSingh oh I forgot, accepting means clicking on the checkmark below the arrows on the left of the answer. I'm telling you this because I see that many users miss that.
    – user1301428
    Apr 8, 2012 at 8:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.