Oh yeah. The "default password==consent" argument has not worked well. This is one of the big differences between many professional penetration testers, and en

Oh yeah. The "default password==consent" argument has not worked well. This is one of the big differences between many professional penetration testers, and enthusiastic amateurs/blue team types. The professional red teamer has typically received long lectures about scope and RoE, and knows exactly how far you can legally go. Check the webpage that corresponds to some suspicious sshd log entries and note that it's a router? Totally fine. Attempt to notify the owner? Equally fine (pro-tip, you might not know who they are, but their ISP sure does). Brute-force their admin credentials (I recognize the hyperbole; the judge won't)? Hand-cuffs. https://ilt.eff.org/index.php/Computer_Fraud_and_Abuse_Act_(CFAA)#Access https://ilt.eff.org/index.php/Computer_Fraud_and_Abuse_Act_(...