Obviously, I'm not a legal expert - talk to a lawyer. However, I believe they do. As you said, you were "injecting stuff," which is malicious activity.They don

Obviously, I'm not a legal expert - talk to a lawyer. However, I believe they do. As you said, you were "injecting stuff," which is malicious activity.They don't know that you didn't have a malicious intent, and unfortunately you have now way of proving that. In general, you should get "approval" for penetration testing from the website's owner. For example, I'm close friends with the Systems Administrator at my school, so whenever I feel that there's a vulnerability in the network, I just tell him and he either allows me to show him, he tells me that I'm wrong and explains the precautions they take against that attack, or he tells me that it would work, but not to do it.