What are the penal consequences for a passive or active scan on a WebApp with no damage? [closed]

Question

Let's say I only trust web applications that I tested myself with some penetration tests. What penal consequences exist for doing a passive scan (eg. building a map of a website site) or an active scan for vulnerabilities (with SQLMap or ZAProxy for instance) without asking its owner and damaging nothing ? Could the owner of the website charge me with nothing more than evidences that I wanted to find vulnerabilities ? Can I be fined when no damage has been done ? What I found online is very specific to each case and despite the usual "Always ask the owner of the website for its approval before testing", I found no cases of people charged for scanning an application.

Answer 1

Sepcifically since you mentionned France: it is illegal to access, modify, maintain your presence in, or delete information in systems you don't have the authorisation to do so.

Furthermore, the attempt to do such an act is punishable as if you did it (no matter how successful it was).

You can expect something like : 150k euros, 5 years in prison (as mentioned on legifrance)

In general, the rule applies differently depending on the country you're attacking from and the country you're attacking in, you could be held liable under multiple jurisdictions or jurisdictions different from you're own. Ask an expert.

As to the last part of your post, having no one convicted of something does not mean it's legal, or that no one will be convicted. In this case, it might just be too costly, or difficult to prosecute, but it could change.

Answer 2

In ideal world, all website/web apps have a policy dealing with pentester/security researcher, lay information disclosure terms and how to deal with it.

However, we are in a non-ideal world. Few organisation has such policies in place, so it is gray idea indeed. Ironically, researcher may get warning letter from lawyer loaded and paranoid company when asking; while some company with damaging PR, will appreciate the "free works" conducted.

Some rules of thumb for pen-testing "research" :

1. Though it is rare, always try to locate the "Term of Services regarding security analytical test. For example, AWS has a penetration test request.

2. Be polite, don't DoS the site. A pen-testing is a not a DoS capacity test.

3. Study the guide for proper pen-testing methodology before proceed.

4. DO NOT publish website vulnerability publicly without consent. Even though Blackhat hacker may already lay their hand on those website. Try to send a polite email and all your research work to protect your ground, just in case it turn ugly.

5. To test opensource webapps vulnerabilities, setup your own (whether using VM, container,etc) test environment. For proprietary apps, you may submit the report to official organisation that monitor exploit. You may even earn some bucks from some company bugs hunting program.

Regarding the law concern, depends on country. Most country has a penalty law against hacking(which including pen-testing without consent) . Since it can hampered research, some country has counterpart law that allow research to be performed. While some just treated it as "one eye close", as long as your pen-test didn't step over the "criminal line"(e.g. DoS a prominent site)

Answer 3

I would say for passive scan, nothing should happen to you. Or is Google taken under arrest? :P For active scan where you would probe services for vulnerabilities (or you will actively try to test some kind of exploits) it would be a problem everywhere in the world. For such actions it is always better to have written agreement from the service provider as in case somebody will blame you you just claim you have it.