4 ms·

I'm not nearly as adept at pentesting but out of curiosity, is there an established point at which you just don't go and farther? Like a point between "get a $

I'm not nearly as adept at pentesting but out of curiosity, is there an established point at which you just don't go and farther? Like a point between "get a $5000 bug bounty" and "CFAA charges and prison time"? The author mentions this at one point but it seemed like more of a gut feeling of not being too intrusive. When I read about this stuff, it seems like half of the articles end with some company either patching or not patching their security holes with some tester maybe making some money and the other half end with someone being charged for accessing public-facing data that wasn't meant to be accessed.

sintheticlabs 10y ago
For me, it boils down to two questions: 1. Does pursuing the vulnerability further benefit the research? 2. Would it cause any damage? If the answers are yes and no, I'll happily see where it takes me and re-evaluate as I go on. With bug bounty programs it's generally expected that researchers are going to poke and prod at things which they otherwise shouldn't, although some programs do specifically state their objections to pursuing issues further. Facebook, for example, would rather you find an issue and report it straight away while others might admire your creativity to show exactly what an attacker could do.