Does anyone know if using Dirbuster [link] to scan for unlisted directories and their contents is (possibly) legal in say the US?
If you don't have permission to perform security testing against a target, don't do it.
In the US, you are definitely at risk of falling foul of the The Computer Fraud and Abuse Act 1986, 1994, 1996 and possibly other acts. It's easy enough to set up a test target of your own, ask a friend for permission to test their site, or use a service such as Webgoat or Gruyere.
Essentially, if you are seen to be someone who knows what you are doing, then even typing in a single-quote to a web form has been enough to be arrested and charged over in the past.
No permission, no pen testing. It's simple. Why risk it.