4 ms·
You are very wrong. Poking and proding is completely legal and isn't going to send anyone to jail. He's not performing a full pen-test on the site. He's not lo
by theboss 13y ago
You are very wrong. Poking and proding is completely legal and isn't going to send anyone to jail.
He's not performing a full pen-test on the site. He's not looking to get a shell. He's just checking out best practices. Is there an HSTS header? Is my input validated? etcetc.
The main hacking law that applies here is the CFAA and Dave definitely isn't violating it. To violate it you have to access something you're not allowed to. Nobody will EVER go to jail for an XSS or the types of things he's poking around for. This is because the computer the code is running on is his own....
- tptacek 13y agoReflected XSS testing can easily end up disrupting the whole site for every user; all it takes is for input to some endpoint to get stored and replayed across the site. Relying on the idea that any kind of active testing against a site you don't own is safe, technically or legally, is a bad idea.
- theboss 13y agoReflected XSS? Do you mean stored? If Dave is testing for reflected XSS he's going to be alert(1)'ing or using img tag....Which is not a persistent xss... For reflected xss to affect every user on the site he's going to have to use his own toolkit to send a malicious link to every user on the site....
- tptacek 13y agoI mean reflected. The kind you don't expect to get stored. If that's a surprise to you, you might not test a lot of websites, because this comes up somewhat regularly. By the way, the XSS payload has nothing to do with the persistence of the attack. You alert() stored XSS in testing too.
- theboss 13y agoI do test a lot of websites actually but I mis-understood what you meant. Like the other guy said this area is grey. If he accidentally finds a stored xss of the magnitude you suggest I'm 100% sure he still wouldn't go to jail. Who tests with a malicious payload? There would be no malicious intent in the situation and no unauthorized access...still.
- tptacek 13y agoYou didn't say this was a grey area. You said "Nobody will EVER go to jail for an XSS" and then cited the CFAA as evidence of that fact, suggesting that you might have some minor gaps on how XSS works and that you definitely have major gaps on how CFAA works. Pro-tip: avoid stringing "Nobody will EVER go to jail for" and "CFAA" together in the same paragraph.
- theboss 13y agoLet me rephrase. Nobody will go to jail for the level of poking and prodding I expect Dave is trying. I'm 100% sure the CFAA won't send anyone to jail for alert(1) My 100% is a gut feeling. I'll quit computers if I'm wrong
- tptacek 13y agoI doubt anyone is going to get in trouble over the PDF report I read about Healthcare.gov, but that's not why I'm commenting.
- rdtsc 13y agoI am probably somewhat wrong, not very wrong. It depends on what "poking and prodding means". That is why I said, it _can_ get him in legal hot water. Even port scanning was not always a free pass. Around 10+ years ago there were a couple of court cases that revolved around it. Luckily the judge ruled in favor of the defendant. But what if it was an SQL injection, or what if he did a GET request and obtain the list of plain text passwords, what if he pinned the CPU to 100% by testing one of the vulnerabilities. That is not 100% clear cut.
- theboss 13y agoIt's not 100% for a nobody like theboss but I can 100% guarantee you the FBI isn't going to come after Dave of all people...an extremely well-respected, knowledgeable, former-NSA employee...
- rdtsc 13y agoI hope not, personally I am on his side as well. But the govt, especially the executive branch, is not a stranger to vindictiveness and petty agenda following prosecutions.