3 ms·
Is it possible to be a "white hat" hacker if you weren't actually contracted by the target for penetration testing?
by machrider 15y ago
Is it possible to be a "white hat" hacker if you weren't actually contracted by the target for penetration testing?
- Karunamon 15y agoIndeed. It's all about what you do as a result of your shenanigans. If you, say, leave a discrete note behind that you have a gaping security hole the size of a hallway on your systems, that would be considered white hat, as opposed to say, stealing a bunch of internal emails, code, etc and selling it or putting it out on torrent sites.
- mjdwitt 15y agoFacebook, Mozilla, Google, and lots of other companies encourage this with exploit bounty programs.
- artursapek 15y agoYes. White hat hackers often approach these large companies' white hat programs themselves.
- michaelbuckbee 15y agoThere is obviously a spectrum to this sort of thing, but I know of many people that will just habitually enter javascript alerts into a web services's forms to see what happens. Mostly this is just to evaluate the product and to see if it is trustworthy, but they'll often send along a polite FYI to the site owners letting them know if they have security issues that need addressing. Actions like that: finding vulnerabilities, privately disclosing them, not disrupting the service, are all fairly innocuous things that most reasonable technically savvy people would consider 'white hat'.
- tptacek 15y agoPeople can and will go nuts if you, for instance, accidentally mess up the DOM for their customers by getting an XSS payload cached and redisplayed in e.g. "saved search" results. It sucks, but if your goal is to avoid legal drama, don't test without permission.