I like the idea of white hat hacking. That's why I'd like to become a pentester in the future. But now I like to learn a bit and was wondering, if it's legal to search for SQL injection, XSS and some other Basic stuff for webapplications, with the intention to report them to the webmaster.
If this matters, I'm from Germany, we have the so called "Hackerparagraph" (§ 202c StGB) which criminalizes the attempt of trying to break into a system or even develop such code/tools. Theoretically, a successful injection would be an act of crime.
But what is, if this is for a good cause? Should I fear that the admin will report my action to the police?
E.g if i write the admin an email like this:
I found a vulnerability for an SQL Injection on yout Page XXX. I had/have no intention to share this vulnerability with somone except you.
I'd recommend you to [explain various things about security]. I hope this helps you and your company to guarantee the safety of yours and your customers.