Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it legal to run a vuln assessment vs. a site other than one you currently own?

Say you own a security software and want to test potential clients' websites for vulnerabilities (without their consent) ?

share|improve this question

closed as not constructive by Greg Askew, Michael Hampton, Evan Anderson, Bart De Vos, squillman Mar 5 '13 at 17:54

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

This isn't a forum for legal advice (and, indeed, you're not going to find one that is, either). What you're describing may well be a violation of the law in many jurisdictions. Legality aside, I wouldn't ever work with a security consultant who came to me with a "pro-bono security assessment". I'd call the cops. There has been a lot of philosophical banter about this kind of thing on the 'net ("xxx hacker finds yyy vulnerability in big-company-name website..." with various conclusions like "...gets a job." or "...gets prosecuted." That's not something I'd gamble with, personally.) – Evan Anderson Mar 5 '13 at 17:29
Is it legal to break the law...? Um... I'm going to have to ask my lawyer about that one. You should do the same. – Michael Hampton Mar 5 '13 at 17:29

First off: I am not a lawyer, I'm not offering legal advice and in no way should you interpret my response as establishing an attorney-client relationship. I would recommend you speak with your lawyer before taking any such risks.

That out of the way, the short is answer is maybe. If you're breaking any laws during your assessment, it's illegal. Something as simple as a port scan cout get you in trouble,even if it doesn't cause a denial of service. Something like exploiting a vulnerability, and using it to pivot to their internal network, even more so.

What I'm guessing you're asking, is whether or not them being a potential client, or you just 'trying to help', protects you in anyway from a legal standpoint. It does not. The only way to legally protect your self would be to have a legal contract stating such.

To reiterate. Not a lawyer, talk with one well versed in this type of thing though.

share|improve this answer
Beware-- giving legal advice after saying "I'm not a lawyer" is not a "get out of practicing law w/o a license prosecution free" card. – Evan Anderson Mar 5 '13 at 17:34
Thanks, You're probably right, I should explicitly state that. – rfelsburg Mar 5 '13 at 17:45
You'd probably be better off not answering this ridiculous question at all. – Tanner Faulkner Mar 5 '13 at 17:50
Perhaps, but I'd prefer to help while protecting myself as best I can. Hopefully keeping someone from making a poor choice in the process. – rfelsburg Mar 5 '13 at 17:55
Depending on how sensitive the skin of the target is, you could end in deep dodo for "just" portscanning. – vonbrand Mar 5 '13 at 21:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.