Penetration Testing: Re: [PEN-TEST] Ethics Scenario

[Darryl Rathbun <darryl.rathbun () PB COM>]

I think actively trying to expand your client base by pen-testing non-clients
goes past "chasing ambulances" into the realm of asking them for "protection
money".  There may also be legal issues involved since your penetration testing
can be construed as "breaking and entering."

If it was truly found by accident (i.e. not an active pen-test) and you did NOT
work for a pen-test organization, I would report it to the webmaster
immediately.  As someone with a motive, I may not even let them know for fear
that I may get a lawsuit!