>Congratulations, you just violated the computer fraud and abuse act.
How can that be illegal?
Granted publishing it should be, but simply testing if someone has left the default password?
Granted publishing it should be, but simply testing if someone has left the default password?
This is one of the big differences between many professional penetration testers, and enthusiastic amateurs/blue team types. The professional red teamer has typically received long lectures about scope and RoE, and knows exactly how far you can legally go. Check the webpage that corresponds to some suspicious sshd log entries and note that it's a router? Totally fine. Attempt to notify the owner? Equally fine (pro-tip, you might not know who they are, but their ISP sure does). Brute-force their admin credentials (I recognize the hyperbole; the judge won't)? Hand-cuffs.
https://ilt.eff.org/index.php/Computer_Fraud_and_Abuse_Act_(...
A court could see "ambiate was authorized to use the work printer for printing -- ambiate hacked the printer to find out the fax machine number and sent a fax" in an absurd world.
This random internet person was never authorized to access this public router. Even if its set to a default username/password. That's the broadness the CFAA.
Just because you set your password to 'password99', doesn't mean you get more protections than the person who leaves their Cisco router set to 'cisco'.