1

Is it legal to run penetration testing tools against all of the sites which are offering a bug bounty according to https://www.bugcrowd.com/bug-bounty-list/, i.e. 1Password, ...Google, ..., Facebook, ... You Need a Budget (YNAB).

  • 6
    You should be reading the program details for each specific vendor to see what targets are in scope and which actions are acceptable. – DKNUCKLES Jun 2 '18 at 11:35
  • 1
    Every one of those vendors has a a specific policy about which of their properties you're allowed to attack and what means you're allowed to use (e.g., many prohibit automated scanners). So the fact that they run a bounty program doesn't mean you're allowed to run all your tools against all their domains. You need to look into their specific program rules first. – Arminius Jun 2 '18 at 11:56
  • "Is it legal?" Depends on the jurisdiction, and is also not a security question. I think you mean to ask about the Terms and Conditions and the Terms of Service for both Bugcrowd and each target you mention, which is also not a security question. And you can look up those things for yourself. – schroeder Jun 3 '18 at 10:23
3

Legal or not, it would not be any useful for them, and certainly wouldn't help you getting any reward. You get a bounty by finding something new. The sites offering bounties are probably already tested using automated tools.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.