Following on from your SQLi example. I'd suggest it depends on the circumstances.

If you pick a random website you've got no authorisation to test and start throwing Burp/Nikto/etc. at it, not legal.

If you're legitimately using a site as a user, and your knowledge spots something that's a weakness, there should be no issue reporting this to the sec-ops guys. The difference is being professional enough not to 'just see'; for example error message pops up potentially indicating SQLi, don't then grab sqlmap.....

(I've reported issues a few times on different sites (sorry, NDAs....), and despite the urban horror stories my insight and suggestions has been both greatly recieved and rewarded by the effected site).

ok then so you spot somthing do you report it ? as someone ethical you should but most people wont becasue the hassel that is involved.

ok so here few senarios

you on site you enter your credit card details what get stored on the site. You then notice they being stored without puttin **** over the last 8 didgits do you report it ?


you using a website and your name is 0'neal this causing an sql injection do you report it ?

Your friend been messing with website trying hack it he tells you about a really bad bug would you report it ?

lets say you want do some research in orcel datasbe but they pretty expensive the only real way to do your research is to be a bit unethical what do you do ?

I also head that at defcon there was a presentation on hacking voip in hotel rooms how ethical is this ? trying hack voip phone in hotel to me is wrong you dont own it dont have permission but how many people would give you permission to do this sort of testing?

I do know the answer but I trying get people view what do they count as ethical and unethical. As I think sometimes when people are doing security reasearch they sometimes cross the line and maybe at night slip into a black hat.

Yes I think I just trying to figure out how people do security research without breaking any rules. As I think sometimes it border line if you break the law or not of course there are some instances where its really obvious.

I sadly missed that talk as i was at the CV place bet it was intresting.

Did you attend the talk on html 5 Andew? I enjoy that talk.