2

We have a pentesting opportunity, and this one is for a company that has multiple data centers around the globe. Now from my research on the Penetration Testing Execution Standard I realize that it's illegal to pentest and do port scans in certain countries.

Is there a resource that can provide me with the legality of pentesting, port scanning and vulnerability scanning by country?

This would go a long way towards helping us pentesters research if certain opportunities are valid or not.

closed as off-topic by PwdRsch, techraf, Anders, Matthew, wireghoul Sep 16 '16 at 4:41

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – PwdRsch, techraf, Matthew, wireghoul
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    If you stick to your customer subnets and will have agreement on that and it will be performed during agreed timeframe it will be OK. The problem is when you are scanning networks which you shouldn't, so it's good to agree on the subnets first. If you are scanning shared hosting - this is impossible to do pen-testing, you'd rather use Test platform for that. – Aria Sep 13 '16 at 20:45
  • The example given on that page is not specific enough to be helpful. Monitoring VoIP would only be wiretapping if you didn't have the permission from all parties. But then why would you pen test the voice part of a VoIP system? Probably more bother than it is worth except in very specific circumstances. I am not aware of any laws anywhere that would be violated if permission is obtained from all parties (including suppliers). Though that might not hold true in some highly restrictive places such as China. In those cases, checking local laws will be needed anyway as things may change. – Julian Knight Sep 13 '16 at 21:10
  • Thank you for your feedback. This has been helpful. I wasn't sure how to go about checking the legality for this in countries like Nepal, but if we have signed permission then it should be fine. Thank you. – sonar Sep 14 '16 at 13:28