I know that this thread mentions that

Essentially, if you are seen to be someone who knows what you are doing, then even typing in a single-quote to a web form has been enough to be arrested and charged over in the past.

But lets say i'm writing a pen test tool that will be doing sqli testing and let it loose on sites that are 'out in the wild'. I'm not going to be doing dumps of any information. But is just the vulnerability scan itself illegal?

  • 5
    While we, as security professionals, do often have to deal closely with legal issues, we're not here to serve up legal advice. This kind of question in particular is highly localized since it depends exclusively on jurisdictional boundaries. – Scott Pack Aug 8 '12 at 20:17
  • 1
    Instead of worrying about legality, just make sure you don't get caught. Use Tor and make sure you hide all your unique browser identifiers or use a proxy that removes them (Privoxy I think). I think it's all in one package now if you download Tor bundle. – Matrix Aug 9 '12 at 6:55
  • 2
    Geez. Don't listen to Matrix. One of the hallmarks of a real security professional is a high ethical and moral standard. You must consider if you "should" more than you consider if you "can." – queso Aug 9 '12 at 21:29

It will depend on the legal system under which it falls. But you are still doing something hostile. Without previous written permission of the siteowner, you are committing a crime.

There is no way of proving you didn't have a malicious intent. Intent is the key component here. A ping can be done to see if your own internet connection is working or if a website might be down because of a failing server. But if your intent is the see if a site/server is vulnerable for a ping fload, then you are possible already committing a felony.

It will be up for a judge to decide, but consider this:

If you would be trying all the doors of a random car in the street to see it's properly locked and someone sees that, would they believe you were just trying to see if it's locked?

  • Would a 'ping' fall under the "trying the door handles" situation? – Digital fire Aug 8 '12 at 20:00
  • Like I said that's up for a judge to decide. With a vulnerability scan you are going way further than just one ping. – Lucas Kauffman Aug 8 '12 at 20:01
  • 3
    We are getting into a discussion, which is more approriate for the chat. But like I said, that's up for a JUDGE TO DECIDE. – Lucas Kauffman Aug 8 '12 at 20:03
  • 2
    Plus if your intent is the see if the site is vulnerable, that would be considered hostile. – Lucas Kauffman Aug 8 '12 at 20:04
  • 1
    In France for example, not allowed access, or maintained presence in an Information System is considered illegal. Trying to do that is considered to be as illegal as actually doing it. – M'vy Aug 8 '12 at 20:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.