Question about legal side of port scanning during bug bounties

Question

Additional info I'm living in the UK(Scotland) and testing targets are scattered around the world(but mainly in UK, EU and USA)

I'm just writing some wrapper around the recon tools that I want to use during bug bounties. The question is about the legal side of using port scans(I'm thinking about using rustScan or nmap). I'm assuming that when it isn't on the list of things that I shouldn't be doing then it should be fine. But what about situations with shared hosting or situation in which the server belong to a different company than web app that I need to test. Any easy way to be sure when it should be fine to use it and when I should do recon without it?

Thanks

Answer 1

Every Internet access company, network, webhost, telephone company, etc, has a TOS (Terms of Service) that 99% of the time forbids any automated access by bots or any type of pentesting such as port scanning.

To legally port scan, you will need to get permission from each part of the network used as to not violate one or more TOSs and be civilly (and possibly criminally) liable.

Of course, many pentesters do not have permission to port scan or look for bugs, but that doesn't absolve them of liability; they are just too many for network admins and company security staff to track and catch.

See Legality of scanning a site with SSLLabs SSL Server Test in order to find and report weaknesses