If I open up the index page of some completely random website (which I have no prior contract to test), and I find myself seeing sensitive information caused by some webapp error, SQL errors for example. That should not be my problem, because I didn't intend to see it and it's not my fault.

Let's put it this way. My request is now HTTP GET /index.php?image=../../../etc/hosts to see my favorite cat picture. Does it sound like "more illegal"?

In both cases I accessed information they were not intended to share without prior permission. So what differentiates regular browsing and looking for vulnerabilities if you technically can't know what data will be returned by the webserver?

closed as off-topic by gowenfawr, Rápli András, PwdRsch, Steffen Ullrich, Rory Alsop Feb 11 '17 at 19:19

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    I'm voting to close this question as off-topic because it is a legal question, probably more suitable for law.SE... The question boils down to "what criteria is a judge or jury likely to use in determining if access was fair and incidental versus targeted and intentional?" Which means it's probably opinion-based, too... – gowenfawr Feb 10 '17 at 20:57
  • edit: migrated to law.stackexchange.com/questions/17083/… if someone wants to follow this – Rápli András Feb 10 '17 at 21:05
  • Rapli - please do not cross post in future. Simply wait for (or request) migration, as that way Rory McCune's answer could have been migrated with it, as opposed to it being sat here on a closed post. – Rory Alsop Feb 11 '17 at 19:19

So the precise answer will depend on the jurisdiction in whereever you are and the the precise Computer crime laws in place in that jurisdiction, however a general point can be made about the example provided.

By placing a website on the Internet and not protecting it from access, it is arguable that this is a statement of intent for the content of the site to be publicly available. If you think about it how do you know that the owners of any site you visit intended the information to be publicly accessible, you don't, so the presumption is that basic page access is allowed.

The example you have as the second part is clearly a directory traversal attack intended to access a file which would not generally be intended to be made public. The defence of "I thought ../../etc/hosts was a picture of my cat" is very unlikely to be acceptable to a court.

A more grey area example would be something like a case where it's allowed to access http://somesite.com/document?itemid=4000 but not http://somesite.com/document?itemid=4001

  • do you say that testing for insecure direct object refs without permission is likely to be legal? – Rápli András Feb 10 '17 at 21:15
  • 2
    nope I didn't say any such thing :) I said it's less obviously wrong than trying directory traversal – Rоry McCune Feb 10 '17 at 21:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.