I am doing testing on some websites and I have found some serious bugs in those sites.

I am not sure if this is legal or not.

  • Is it ever legal?
  • How can I find out if it's legal where I live?
  • What can I do to ensure I'm legally protected?
  • 2
    If only Andrew Auernheimer could answer this question... maybe he will when he gets out of jail. – Ladadadada Apr 10 '13 at 15:00
  • Yup. Largely depends on how much the government (dis)likes you. – Polynomial Apr 10 '13 at 16:14
  • And it doesn't necessarily depend on whether your government is okay with it, but if the other government isn't, then you may find yourself forcibly repatriated. – Rory Alsop Apr 10 '13 at 17:08

Legality depends on the country... but, on a general basis, making tests on Web sites owned by other people without their consent is frowned upon and can get you in a lot of legal trouble.

Some site owners would be happy at learning of their security flaws and thank you warmly. Many others will think of it as a thinly disguised blackmail attempt, then call the cops and skin you alive.

| improve this answer | |
  • But thomas Pornin,Whenever i found the bug immediately i use to report that particular website.They usually ask me to tell the details and in the next mail i use to give them all the details....i never think to harm the owner of the site....still Is it illegal.? – Sunil dadhich Apr 10 '13 at 14:56
  • 6
    Finding the bug in the course of normal site usage would be perfectly legal; and then reporting it to the site administrator would be the courteous way of dealing with it. Making explicit tests meant to uncover common bugs (e.g. using ' OR 1==1 as user name to test for SQL injection) is not "normal usage" and, in most countries, is (at least theoretically) punished by Law. – Thomas Pornin Apr 10 '13 at 15:01

I am not a lawyer in any way shape or form, you are responsible for your own actions.

The answer is, it depends. First it depends on what country you live in along with any local laws. Also if you are sending data to the server it is much more likely to be illegal (Testing for SQL injection, stored/reflected xss, etc) than if you are just doing static analysis on javascript, noticing that they do not have a CSRF token on a sensitive transaction, noticing that they have a weak cipher set in their SSL or any sort of client side tests. For example reverse engineering is legal under US law, (There are exceptions however in cases of the DMCA or unauthorized access) but the moment you send a malformed packet to the server to see the response, you violated the CFAA.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.