Re: Fw: [Full-disclosure] scanning

According to

"Cuthbert is accused of attempting a directory traversal attack on the site which handles credit card payments on behalf of the
Disasters Emergency Committee." ( and
"After making a donation, and not seeing a final confirmation or thank-you
page, Cuthbert put ../../../ into the address line. If the site had been
unprotected this would have allowed him to move up three directories" (

This is legal hair-splitting. Yes, you are right. Who knows whether the
judges would consider "port scanning" just as bad as "illegally attempt of
securing access to a computer" (as defined in the UK "Computer Misuse Act
1990 (c.18)").

----- Original Message ----- From: "Drew Masters" <drewmasters@xxxxxxxxx>
To: <full-disclosure@xxxxxxxxxxxxxxxxx>
Sent: Friday, June 02, 2006 9:33 AM
Subject: Re: Fw: [Full-disclosure] scanning

It's worth looking into the Daniel Cuthbert case in the UK.


On 02/06/06, Lawrence Tang <tang.luong@xxxxxxxxx> wrote:
> "Vulnerability test" is not "port scan". It could involve attempt to
> "penetrate" or even penetration of the website through a vulnerable
> script for instance. In this particular case, we don't know what RA 8792
> the Philippines says and/or what Tridel Technologies, Inc did. But in
> general, "port scan" is supposed to be only checking which TCP/IP ports
> open for connection without going through the entire process of
> There is no question of penetration. How could any authority prosecute
> legitimately? If I, by mistake, attempt a connection to a site, could I
> in legal trouble? How many ports constitute "port scanning"?
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -