Is It Illegal To Test A Website For Exploits Regarding My Personal Info?

Question

American here. I'm not a hacker or anything, just a normal computer science student. Anyways, I believe that my university has left an exploit open through their hub where anyone can use the modular apps to gain access to your:

Last 4 digits Of SSN, University ID, and possibly your password.

If I were to test the exploit by only using the public interface they provide, on myself, would this be considered illegal?

I would need to use a selenium script to automate attempts on finding the last 4 digits of the SSN - because it appears the database doesn't have a limit on how many attempts you can make.

Of course I would be trying to gain access to my own data, not anyone elses.

Oh and of course I would tell the Uni that this was a problem. I just didn't want to message them for nonsense.

Answer 1

In a narrow sense, since you are a student at the U, you are bound by a contract you signed when you registered for classes. Read it, and you'll probably find a clause or two that states that you are not allowed to abuse, script, attempt logins or otherwise use the computer systems in any way other than typical, day to day use. The U's recourse is to kick you out and possibly take you to civil court to recover damages, and possibly refer you to the local county attorney for criminal charges, depending on the existence of criminal statutes for computer access in your jurisdiction.

In a broad sense, pentesting can be either a civil infraction or a crime, depending on the terms of service for the system you are trying to exploit, what exactly you do, the jurisdiction, etc. See State Computer Crime Statutes and Federal Computer Fraud and Abuse Act - Wikipedia.

See also LE answer When is a permission required to attack a system?