The very interesting question I have is when “ethical” hackers/pen testers harvest these repositories of stolen credentials to then use them in pen testing for paying clients what laws are broken if any? If a lazy hacker leaves their captured credentials out on un insecure, public facing server and then an “ethical” hacker grabs them for their own paid services, it seems to me that it's stealing already stolen goods.

What about a penetration tester taking credentials gathered from a paid/contracted job and adding them to a database to be used in future client (not affiliated with the previous client) jobs?

This is in the U.S

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.