Never attack something you don't have a permission for!

This is one of the golden rules of penetration testing, yet it's surprisingly unclear. What exactly counts as an attack, and when do I need permission?

Let's consider some examples:

Example 1

I want to log in on example.com, and accidentally type my password incorrectly, yet the website authenticates me successfully. Baffled, I try again, this time with a completely wrong password. Again, the website authenticates me successfully. It seems to me as if the back-end doesn't check the password at all! Would I have needed permission for this?

Example 2

I buy myself a set of Bluetooth speakers. They come in a cheap "basic" and a more expensive "premium" variant. The only difference is that the more expensive ones have better sound quality.

After opening the cheap ones up, I realize that they are built identically to the expensive ones, and just have a jumper on the circuit board that determines whether the speakers are "basic" or "premium". I change the jumper, and sure enough, the sound is better now.

Realizing what I have done, I ask myself whether I needed permission from the vendor for this.

Example 3

I use a website like TIO to execute some code. Out of curiosity, I try system("cat /etc/passwd") and sure enough, I get a file in the passwd format. I poke around the system a bit more to find the webroot and write a file into it. Again, I can open this file now. I could basically do anything on the web server, including modifying the website, visible to other users.

Did I need permission from the website owners for this?

Example 4

My 12 year old cousin shows me a browser game he likes to play. As a joke, I log in as admin'; -- and the admin interface revealed itself to me in all it's unescaped, unprepared glory.

Did I need permission from the game's owners for this?

As shown in these examples, I didn't do anything malicious, and the difference between legitimate use an an attempted "attack" is difficult to tell - at least on closer inspection.

As such, is there a clear line when exactly permission is necessary?

This question was originally asked in Security.SE. I am mostly interested in answers relevant to laws in the European Union.

  • 1
    Most of what you are describing isn't something you'd experience in pentesting. Permission to attack is only relevant when you have a contract and need to determine what is in-scope. If you buy your own stuff, you can generally do whatever you want with them. If you're dealing with, say, company Bluetooth speakers, then you would need the contract to clearly spell out that you are allowed to test them.
    – forest
    Aug 5, 2019 at 9:28
  • 1
    If you need a clear line, you'll have to ask a court for that. If you ignore the need for a permission, sooner or later a court will show you when you crossed the line...
    – Josef
    Aug 5, 2019 at 9:29
  • 3
    This is purely a legal question, asking whether you're allowed to flip a switch on a PCB given that this unlocks premium features, enter a simple sql injection for fun, etc., or if one would need permission from the vendor for that. I've flagged the question to move it to the law stackexchange site. They may have less knowledge about admin';-- but they should understand the idea of entering a simple test string and be able to answer the point of this question, which is purely legal.
    – Luc
    Aug 5, 2019 at 9:51
  • 3
    Additionally, you may want to edit the question to clarify which country this is supposed to be in, since that will change the answer. I'm not sure about specifics, but I'm fairly sure reverse engineering laws (relevant to your bluetooth speaker example) are an example of something that frequently differs even between neighbouring countries.
    – Luc
    Aug 5, 2019 at 9:54
  • 1
    The country you reside in dictates the laws you are required to follow.
    – forest
    Aug 5, 2019 at 10:49


You must log in to answer this question.

Browse other questions tagged .