Would designing a crawling bot to detect and inform vulnerable website owners be legal?
Assuming that you had the website owners express permission to test for the vulnerability - probably, depending on your location (UK/US/EU laws appropriate).
Having a crawler that scans for the vulnerability is (in my opinion) almost certainly breaking some law in whatever country. Not only this though, imagine it from the business/website owner's perspective - what's your real intention?
As a side note - You've got to be careful going down this route as, even though you're trying to do the right thing (presumably) and make a small amount of money (again, assuming) this can be interpreted in two different ways:
- I know how to fix this issue, I'll let the client know and they can pay me a tiny fee for doing so (or free because I care about security).
- I know how to fix this issue, I'll let the client know and force them to pay me a ransom or else I'll tell everyone about their flaw.
Almost everyone reading your email/letter or listening to your phone call is going to think they're being scammed. Further to this, if you inform a client that the vulnerability exists and that you've scanned their server/site and found it there - you've just sent them an email saying the following (in the eyes of the UK law, others might be different):
"Hi, I scanned your website without permission and discovered a flaw. I can bypass security/access confidential data. Please secure this."
What happens if within 3 minutes of sending that email, the server is compromised using the method your just described? Even if they know it's not you, they'll be ticked off that they've just lost data and assume it was you. Even if there's a lack of evidence it's still hassle you'd rather be without.
I'd suggest creating a website where people can test their own sites and servers by typing a hostname/IP Address into a box and agreeing to some t's and c's that make you non-liable.