Never attack something you don't have a permission for!
This is one of the golden rules of penetration testing, yet it's surprisingly unclear. What exactly counts as an attack, and when do I need permission?
Let's consider some examples:
I want to log in on
example.com, and accidentally type my password incorrectly, yet the website authenticates me successfully. Baffled, I try again, this time with a completely wrong password. Again, the website authenticates me successfully. It seems to me as if the back-end doesn't check the password at all! Would I have needed permission for this?
I buy myself a set of Bluetooth speakers. They come in a cheap "basic" and a more expensive "premium" variant. The only difference is that the more expensive ones have better sound quality.
After opening the cheap ones up, I realize that they are built identically to the expensive ones, and just have a jumper on the circuit board that determines whether the speakers are "basic" or "premium". I change the jumper, and sure enough, the sound is better now.
Realizing what I have done, I ask myself whether I needed permission from the vendor for this.
I use a website like TIO to execute some code. Out of curiosity, I try
system("cat /etc/passwd") and sure enough, I get a file in the
passwd format. I poke around the system a bit more to find the webroot and write a file into it. Again, I can open this file now. I could basically do anything on the web server, including modifying the website, visible to other users.
Did I need permission from the website owners for this?
My 12 year old cousin shows me a browser game he likes to play. As a joke, I log in as
admin'; -- and the admin interface revealed itself to me in all it's unescaped, unprepared glory.
Did I need permission from the game's owners for this?
As shown in these examples, I didn't do anything malicious, and the difference between legitimate use an an attempted "attack" is difficult to tell - at least on closer inspection.
As such, is there a clear line when exactly permission is necessary?
This question was originally asked in Security.SE. I am mostly interested in answers relevant to laws in the European Union.