SQL injection

[mingL]

Let's assume that I coincidentally found a website which has a high SQL injection vulnerability.
I know that it is in general illegal to attack a website with SQL injections, but if i tried it out and after that informed the website management about that weak spot, would it then be legal, as i help them to find an error - I would of course not delete or modify any data , but just try to read the database - ? ...
Thank you - mingL

 

[FlyingRon]

Wrong, is wrong. If you must do something, find the site admin and warn them. Other than that, hacking will likely get you in trouble no matter what you CLAIM your motivations are.

Of course, you could just change your name to Robert'; DROP TABLE Students; --

 

[quincy]

Let's assume that I coincidentally found a website which has a high SQL injection vulnerability.
I know that it is in general illegal to attack a website with SQL injections, but if i tried it out and after that informed the website management about that weak spot, would it then be legal, as i help them to find an error - I would of course not delete or modify any data , but just try to read the database - ? ...
Thank you - mingL

Are you in the U.S., mingL?

Although I am pretty sure you knew the answer to your question before you asked it, you were smart to confirm.

If you know or learn of a website's vulnerability, contacting the administrator of the site would be nice.

 

[mingL]

No, I'm from Germany...

 

[quincy]

No, I'm from Germany...

Thank you for answering my question. I thought you might not be in the U.S.

The advice remains the same. Pointing out to administrators of a website any security vulnerabilities you have noticed would be the correct thing to do.