Is it usually authorized to run systematic information gathering tools ? I'm talking about tools like nmap, knock, dirb and so on. I'm obviously talking about running them on public websites without consent.
closed as off-topic by Steffen Ullrich, Steve, Benoit Esnard, Arminius, Bacon Brad Aug 1 '17 at 21:57
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "This question does not appear to be about Information security within the scope defined in the help center." – Steffen Ullrich, Steve, Benoit Esnard, Arminius, Bacon Brad
On a general basis, as long as you are not using a website the authorized way, then you can assume it is unauthorized by default.
Some websites may explicitly authorize the use of automated scanning tools. A classical example of this is Nmap's ScanMe page. In this case the page clearly state the authorization and the associated limitations.
Some general websites also offer bug bounties allowing to some extend the search of vulnerability on their systems. Such website may or may not authorize the use of automated tools, this is usually clearly stated in their bug bounty details.
The "authorized" and "unauthorized" statements however have to be distinguished from the "legal" and "illegal" statements. In some cases, the first ones may have nothing to do with the later ones. In particular, before engaging in any activity which may, even remotely, be considered offensive, ensure that the explicit authorization has been issued by someone in measure to issue it and in full knowledge of any potential consequences (in particular, before allowing such use, the target must check if his hosting company allows it).
Laws controlling such activity are far more complex than one may think, even more when the scanning source and destination (either its HQ or its servers) are located in different jurisdictions. Things may quickly go wrong and out-of-hand. What if the server you were scanning crashed during your scan and the local sysadmin made no backup? Even if your scan may be technically unrelated to the crash, expect to be designated as the main responsible for all the damages and the associated losses.
In doubt, either contact a lawyer before doing anything or abstain.
As a side note, you remain free to scan your own devices on your own network. Simply using virtual machines in your own LAN is usually enough for most personal tests.