[clrlslwi]

Well supposedly you make a simple site where you get +1 points after clicking a button but you decide to send the same request programmatically and infinitely

It's not illegal. Things get a bit grey if you accepted a ToS, and you're selling the exploit, or they have security measures in place trying to stop you from doing it.

If they have a ToS, AND you're selling it, you can get fucking destroyed depending on the ToS.
https://en.wikipedia.org/wiki/Tortious_interference

If they have security measures in place trying to stop you, they can leverage DMCA to fuck you.
https://en.wikipedia.org/wiki/Digital_Mi...yright_Act

[Ðr1ps]

It's not illegal. Things get a bit grey if you accepted a ToS, and you're selling the exploit, or they have security measures in place trying to stop you from doing it.

If they have a ToS, AND you're selling it, you can get fucking destroyed depending on the ToS.
https://en.wikipedia.org/wiki/Tortious_interference

If they have security measures in place trying to stop you, they can leverage DMCA to fuck you.
https://en.wikipedia.org/wiki/Digital_Mi...yright_Act

There's nothing stopping me, you can literally copy the cURL sent after clicking the button and then just make a script out of it. And the only thing their ToS says (which you do have to accept) is you won't get whatever they have if you exploit it somehow.

[Prince™]

Illegal yes ofcorse. But totally depends on the website's owner. If you're going to report the exploit, few appreciate it and reward you as well.

[Rihsky]

Usually if you have to ask if something is legal or not, it usually isn't. In this case, no it is not.