4

Let's say I only trust web applications that I tested myself with some penetration tests. What penal consequences exist for doing a passive scan (eg. building a map of a website site) or an active scan for vulnerabilities (with SQLMap or ZAProxy for instance) without asking its owner and damaging nothing ? Could the owner of the website charge me with nothing more than evidences that I wanted to find vulnerabilities ? Can I be fined when no damage has been done ? What I found online is very specific to each case and despite the usual "Always ask the owner of the website for its approval before testing", I found no cases of people charged for scanning an application.

closed as off-topic by Sjoerd, Stephane, Steffen Ullrich, mgjk, Arminius May 29 '17 at 12:06

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Sjoerd, Stephane, Steffen Ullrich, mgjk, Arminius
If this question can be reworded to fit the rules in the help center, please edit the question.

  • In which country are you testing? – anon May 29 '17 at 9:56
  • France. The law depends on the country in which I'm testing or the country in which the app servers are ? – Shashimee May 29 '17 at 10:00
  • 2
    You should try law.stackexchange.com. We're not law experts here and the answer it really dependent on the country you're attacking from, and the country you're attacking in. – M'vy May 29 '17 at 10:00
  • As my question is about PenTesting and its consequences, and that the laws are very specific to this type of case, I'm not sure it would fit in the law section. Since we have professionnal pentesters in this area, I thought they'd know more about this topic. – Shashimee May 29 '17 at 12:38
5

Sepcifically since you mentionned France: it is illegal to access, modify, maintain your presence in, or delete information in systems you don't have the authorisation to do so.

Furthermore, the attempt to do such an act is punishable as if you did it (no matter how successful it was).

You can expect something like : 150k euros, 5 years in prison (as mentioned on legifrance)

In general, the rule applies differently depending on the country you're attacking from and the country you're attacking in, you could be held liable under multiple jurisdictions or jurisdictions different from you're own. Ask an expert.

As to the last part of your post, having no one convicted of something does not mean it's legal, or that no one will be convicted. In this case, it might just be too costly, or difficult to prosecute, but it could change.

  • Where did you find the " 25k euros, 3 years in prison" please ? – Shashimee May 30 '17 at 9:27
  • 1
    It may have been updated: legifrance.gouv.fr/…. 323-2 states 150k 5 years. – M'vy May 30 '17 at 12:39
  • If you can edit your answer to include the link, I will validate it :) Thanks ! – Shashimee May 30 '17 at 12:52
3

In ideal world, all website/web apps have a policy dealing with pentester/security researcher, lay information disclosure terms and how to deal with it.

However, we are in a non-ideal world. Few organisation has such policies in place, so it is gray idea indeed. Ironically, researcher may get warning letter from lawyer loaded and paranoid company when asking; while some company with damaging PR, will appreciate the "free works" conducted.

Some rules of thumb for pen-testing "research" :

  1. Though it is rare, always try to locate the "Term of Services regarding security analytical test. For example, AWS has a penetration test request.

  2. Be polite, don't DoS the site. A pen-testing is a not a DoS capacity test.

  3. Study the guide for proper pen-testing methodology before proceed.

  4. DO NOT publish website vulnerability publicly without consent. Even though Blackhat hacker may already lay their hand on those website. Try to send a polite email and all your research work to protect your ground, just in case it turn ugly.

  5. To test opensource webapps vulnerabilities, setup your own (whether using VM, container,etc) test environment. For proprietary apps, you may submit the report to official organisation that monitor exploit. You may even earn some bucks from some company bugs hunting program.

Regarding the law concern, depends on country. Most country has a penalty law against hacking(which including pen-testing without consent) . Since it can hampered research, some country has counterpart law that allow research to be performed. While some just treated it as "one eye close", as long as your pen-test didn't step over the "criminal line"(e.g. DoS a prominent site)

0

I would say for passive scan, nothing should happen to you. Or is Google taken under arrest? :P For active scan where you would probe services for vulnerabilities (or you will actively try to test some kind of exploits) it would be a problem everywhere in the world. For such actions it is always better to have written agreement from the service provider as in case somebody will blame you you just claim you have it.

Not the answer you're looking for? Browse other questions tagged or ask your own question.