Post #4203781

Thinking back to my consultant pentester days and the importance of scope. We used automated tools, spiders and scanners, trying to cover an entire web application in (usually) a very short test period. I made sure my scope was set before doing anything more than reading, but some systems (and some maintainers) treat even active scanning as a hostile action. If the tool went out of bounds, especially if it went so far out of bounds as to take hostile action against at least two out-of-scope systems, I would have been personally at risk for litigation. I also would have faced professional consequences, and rightly so. But do it with a liability laundering machine, and somehow it's fine.