Is it legal to run a vuln assessment vs. a site other than one you currently own?
Say you own a security software and want to test potential clients' websites for vulnerabilities (without their consent) ?
As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.
First off: I am not a lawyer, I'm not offering legal advice and in no way should you interpret my response as establishing an attorney-client relationship. I would recommend you speak with your lawyer before taking any such risks.
That out of the way, the short is answer is maybe. If you're breaking any laws during your assessment, it's illegal. Something as simple as a port scan cout get you in trouble,even if it doesn't cause a denial of service. Something like exploiting a vulnerability, and using it to pivot to their internal network, even more so.
What I'm guessing you're asking, is whether or not them being a potential client, or you just 'trying to help', protects you in anyway from a legal standpoint. It does not. The only way to legally protect your self would be to have a legal contract stating such.
To reiterate. Not a lawyer, talk with one well versed in this type of thing though.
|show 1 more comment|