So I've begun learning to penetration test and I want to try it on a real system, (apart from my own), and so I have asked a friend if I can hack their computer. He is as interested as I am on the subject of computing and has agreed. I'm just wondering if it is strictly legal, and if it is likely for anyone else to be checking his system (doubtful, I know). As a point of reference, I live in Australia..
If the system is private and you don't use any other infrastructure or services to carry out your testing, then you probably don't violate any statutes.
- If you are attacking through an ISP - get their agreement first, as they could see what you are doing as an attack and pass the info to law enforcement
- If there is data on the server which could come under data protection regulation then you want to look into implications of having that data end up on your computer as part of the attack.
- and as @espengra says - get approval in writing, in case you break something and your friend decides to take you to court!
This constitutes as a fairly regular pentest and is indeed legal if the victim system's legal owner (your friend) allows you to perform this test. Make sure to have the entire scope of the test declared in a written contract between the two of you just to be sure if he should change his mind later on.
The scope would include the physical equipment involved, as well as the targeted software.
Why don't you just knock up some virtual servers to play with .. or get some vulnerable iso's to play with (metasploitable comes to mind for one)
You could always do a p2v of a physical system so you have it as a virtual machine. That way you can take backups and restore points etc.
Otherwise, as the posts above state, get a written agreement, and ensuer that your ISP allows it (I'm pretty sure Telstra don't like it)
PS - im from Australia too :)
You should check out http://www.pentest-standard.org/index.php/Pre-engagement for all your scope and agreement stuff