You're right. There are plenty of legitimate companies that offer security services whether it's pentesting or DOS attacks. The dark web/malicious providers nor

You're right. There are plenty of legitimate companies that offer security services whether it's pentesting or DOS attacks. The dark web/malicious providers normally say something like: "this can only be used on machines you have permission to test" while doing absolutely no verification that the services are owned by the purchaser.