Just wondering what methods used in Pen-testing (Denial of service, dropping a shell, phishing, etc.) would land you in legal trouble in Australia?

  • 2
    I'm voting to close this question as off-topic because it is a purely legal question. It would be on-topic at Law. Jan 12, 2019 at 5:23

2 Answers 2


Do anything you have written, legally binding permission to do. Don’t do anything else.

Those dos and donts apply pretty much everywhere and should be followed. There may be some gray areas such as stumbling onto a bug or glitch on a web facing portal, and you can report those, but don’t start anything intentionally just to have fun. This is where you can get in a lot of trouble really quick.


If you're hired by a company to pentest their system, this is a private agreement between you and the company. You can pretty much do anything, as long as it's agreed upon with the company beforehand. Most companies draw the line so that no real damage to customer data or company reputation, and no unnecessary damage beyond the minimum necessary to demonstrate the vulnerability, but ultimately it'll be up to the agreement to what extend you can go to.

One thing to be careful though, is to make sure you ask the right people for the permission. Often times, a company runs their systems on someone else's infrastructure, for example, with cloud services, in which case you may have to get agreement from them as well.

If you aren't hired by the company, and discovered a bug accidentally, then check out if the company has bug bounty policy and what those policies allows. Don't try to pry things beyond the immediate issue you initially discover. If the company doesn't have a bug bounty policy, then don't even tempt it.

Not the answer you're looking for? Browse other questions tagged or ask your own question.