software hacking
Legal issues of searching for software vulnerabilities
<p>What are the legal issues about finding zero-day vulnerabilities (i.e. previously unknown vulnerabilities in a program/website) and what is the standard legal practices before trying to find them if myself and the web app is being run in the legal jurisdiction of England?</p>

<p>As an example, I haven't tried exploiting anything yet, however, I think I've found something vulnerable in a web app. I want to try an exploit it and hopefully get a CVE but I'm not sure how to go about doing this legally.</p>

<p>Should I go ahead and try exploiting it, and even though I'm looking to help identify a vulnerability and disclose it to the company, should I use a VPN/Tor?</p>

<p>Should I contact the company and explain that I think I may have found something vulnerable and go ahead straight away or wait for their response to allow me to?</p>

<p>Yes, you must ask their permission if it is a web app, because you would be breaking into their server and would be committing computer tampering or whatever the similar crime is your jurisdiction. </p>

<p>If you are exploiting something on a device you own, that is OK, but you can not break into someone else's server without permission. </p>

<p>Assuming you have not been authorised or given permission to do so, in the jurisdiction of England and Wales, in the circumstances you describe, I think you would commit an offence under s1 Computer Misuse Act 1990, "unauthorised access to computer material."</p>

<p><a href="https://www.legislation.gov.uk/ukpga/1990/18/section/1" rel="nofollow noreferrer">https://www.legislation.gov.uk/ukpga/1990/18/section/1</a></p>

<p><a href="https://www.cps.gov.uk/legal-guidance/computer-misuse" rel="nofollow noreferrer">https://www.cps.gov.uk/legal-guidance/computer-misuse</a></p>

<p>In that context it doesn't matter whether your intention was good or bad, merely that you behaved without authorisation. (Whether you would be prosecuted is another matter.)</p>

<p>If you want to confirm the exploit legally you must ask for and receive the appropriate permission to do it.</p>
