so how do you go about pentesting your own domain hosted on someone elses server? Its pretty important to ensure that your site is safe from the script kiddies, but at the same time you don't want to get your domain/website pulled just because you tested it for vulnerabilities! Regarding alice next door...this does beg the question about how safe pen testing is legally - what if you mistyped the ip address range (or was given the wrong data by the client?) Even if you've got permission from your client you've still "accessed" someone elses pc without authorisation....and just how does an automated scan of ip address/ports act as "accessing" a pc anyway?

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/167/20493#20493