[777]

Is ethical hacking ACTUALLY ethical or just a sanitized term for activities that could still cause harm? The boundary between white hat and black hat seems more like a convenient fiction than a clearly defined line when we look at the techniques being used in both instances.

What boundaries should exist between penetration testing and actual criminal activity? I feel like many companies hire security researchers to do essentially the same things criminals do, just with permission slips.

Who REALLY benefits from bug bounty programs? Are the companies protecting themselves or the researchers who often get paid a fraction of what the vulnerability is worth to criminal enterprises? Even looking on the person doing the bug bounty, they can be scammed out of money if the company said something like, "you found an old bug someone else already found so you are uneligable for payment". Crazy business to get into but one thing remains true....everyone on each side trying to make and keep as much money as they can, pushing the limits...

Are you one of these people?

[Pr0m3th3us]

Depends on how you interp it honestly. Of course anything good can be used for bad and anything bad can be used for good. Its the way of the world man.

[ttbr0]

Is ethical hacking ACTUALLY ethical or just a sanitized term for activities that could still cause harm? The boundary between white hat and black hat seems more like a convenient fiction than a clearly defined line when we look at the techniques being used in both instances.

What boundaries should exist between penetration testing and actual criminal activity? I feel like many companies hire security researchers to do essentially the same things criminals do, just with permission slips.

Who REALLY benefits from bug bounty programs? Are the companies protecting themselves or the researchers who often get paid a fraction of what the vulnerability is worth to criminal enterprises? Even looking on the person doing the bug bounty, they can be scammed out of money if the company said something like, "you found an old bug someone else already found so you are uneligable for payment". Crazy business to get into but one thing remains true....everyone on each side trying to make and keep as much money as they can, pushing the limits...

Are you one of these people?

it's incredibly well defined. it is exactly a permission slip and that's the very well defined boundary between your butt hole staying tight and not. otherwise, it depends. mostly techniques are generally the same but obviously if you are penetration testing, one of the largest differentiating factors is time. an adversary will have infinite time to prepare and study their target while a pentester is limited to their scope.

dont get me started on bug bounties. i think they are the plague for multiple reasons, especially their predatory pay out system and using it as an attempt to mask vulnerabilities in a "pay you to shut up" kind of way. ive reported multiple vulnerabilities to major software vendors through bug bounties and there is no public record of any of it so no one knows whats up. they also took comically long to fix their bugs. some programs are good, dont get me wrong. lots of them are just disgusting.

personally i dislike the term "ethical hacking" anyway, its cringe and makes me want to throw up. its not a term that is used in the industry very much either, at least not in my spaces or groups. we use terms like "pentester" and "red/blue teamer" or "threat actor" and "adversary" etc.

[DramaKing]

It can feel like ethical hackers only get paid to keep them honest.

[#TR0J4N]

It can feel like ethical hackers only get paid to keep them honest.

And if they are not paid enough they can go rogue 🤣

[200ok]

Is ethical hacking ACTUALLY ethical or just a sanitized term for activities that could still cause harm? The boundary between white hat and black hat seems more like a convenient fiction than a clearly defined line when we look at the techniques being used in both instances.

What boundaries should exist between penetration testing and actual criminal activity? I feel like many companies hire security researchers to do essentially the same things criminals do, just with permission slips.

Who REALLY benefits from bug bounty programs? Are the companies protecting themselves or the researchers who often get paid a fraction of what the vulnerability is worth to criminal enterprises? Even looking on the person doing the bug bounty, they can be scammed out of money if the company said something like, "you found an old bug someone else already found so you are uneligable for payment". Crazy business to get into but one thing remains true....everyone on each side trying to make and keep as much money as they can, pushing the limits...

Are you one of these people?

youre right about this "just a sanitized term for activities that could still cause harm" and to reply on what you said about the bug bounty programs, yes, THE best benefits you gain while hunting is how to hunt, and how to find exploits, in my opinion thats better than any type of $$

(you're 100% right about "you found an old bug someone else already found so you are uneligable for payment" the way my days go is they usually just say there's no risk with my bounty in which could harms the website directly, but now if I send a whole bunch of fake data to a 3rd party website that the (main) site im looking on uses then they are being fed fake data which could and most likely will cause problems.

its like if a whole lotta people buy blue cheese and love it, but I send fake data that everyone loves yellow cheese more, then they will start stocking more yellow than blue and people will get mad that they stopped having a lot of blue, then those people will switch to a different store.. to get more blue.