1

Is it legal to run penetration testing tools against all of the sites which are offering a bug bounty according to https://www.bugcrowd.com/bug-bounty-list/, i.e. 1Password, ...Google, ..., Facebook, ... You Need a Budget (YNAB).

closed as off-topic by DKNUCKLES, schroeder Jun 3 '18 at 10:23

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – DKNUCKLES, schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 5
    You should be reading the program details for each specific vendor to see what targets are in scope and which actions are acceptable. – DKNUCKLES Jun 2 '18 at 11:35
  • 1
    Every one of those vendors has a a specific policy about which of their properties you're allowed to attack and what means you're allowed to use (e.g., many prohibit automated scanners). So the fact that they run a bounty program doesn't mean you're allowed to run all your tools against all their domains. You need to look into their specific program rules first. – Arminius Jun 2 '18 at 11:56
  • "Is it legal?" Depends on the jurisdiction, and is also not a security question. I think you mean to ask about the Terms and Conditions and the Terms of Service for both Bugcrowd and each target you mention, which is also not a security question. And you can look up those things for yourself. – schroeder Jun 3 '18 at 10:23
3

Legal or not, it would not be any useful for them, and certainly wouldn't help you getting any reward. You get a bounty by finding something new. The sites offering bounties are probably already tested using automated tools.

Not the answer you're looking for? Browse other questions tagged or ask your own question.