0.6 Ethics and the law — read this before Part 2

This is the only part of this guide with legal consequences.

   +----------------------------------------------------------------+
   |  ATTACK ONLY:                                                   |
   |    * systems you personally own                                 |
   |    * the lab you built in 0.4                                   |
   |    * deliberately vulnerable targets (Juice Shop, HackTheBox,   |
   |      TryHackMe, PortSwigger Academy, CTFs)                      |
   |    * systems you have WRITTEN permission to test                |
   |                                                                 |
   |  NEVER:                                                         |
   |    * scan, probe, or test a system you don't own                |
   |    * "just check if it's vulnerable" on a live site              |
   |    * test your employer's systems without written authorisation |
   |      from someone empowered to give it                           |
   +----------------------------------------------------------------+

Why this matters practically: unauthorised access is a criminal offence in most jurisdictions (the Computer Misuse Act in the UK, the CFAA in the US, and equivalents elsewhere). Good intentions are not a defence. Neither is "I didn't change anything." Port scanning a third party can itself be an offence in some places.

If you find a vulnerability by accident: stop, don't dig further, and report it through the organisation's security contact (look for /.well-known/security.txt or a bug-bounty page). Document what you did, exactly.

At work: get authorisation in writing, with scope and dates, before you test anything. Every professional does this. It protects you as much as them.