Where to practise hacking legally (and what will get you arrested)

Short answer: practise on systems you own, on deliberately vulnerable machines in your own lab, on platforms built for it, or inside a bug bounty program's stated scope. Everything else — including a single scan of a company you do not have written permission to test — is a criminal offence in most countries, regardless of intent or damage.

This is the article every beginner should read before the first tool is installed, and the one most people find after an uncomfortable email. The rule is simpler than the folklore around it, and the consequences are harsher.

The rule, stated plainly

Access to a computer system is lawful when the person entitled to grant it has granted it. That is the entire test in most legal systems — the United States' Computer Fraud and Abuse Act, the United Kingdom's Computer Misuse Act, Canada's Criminal Code section 342.1, France's articles 323-1 and following, and their equivalents elsewhere.

Three consequences follow, and they surprise people:

Intent is largely irrelevant. "I only wanted to help" is not a defence. Unauthorised access is the offence; what you did afterwards affects the sentence, not the guilt.

Damage is not required. You do not have to break anything. Connecting to a service you were not permitted to connect to can be enough.

Reporting afterwards does not cure it. Finding a vulnerability and disclosing it responsibly is admirable, and it is still unauthorised access if you had no permission to look. Several well-known cases involved people who reported what they found.

The safe posture is boring and correct: written authorisation before the first packet, or a target that exists to be attacked.

Is port scanning illegal?

The honest answer is: it depends on the jurisdiction, and treating it as legal is a bad bet.

Some courts have treated unsolicited scanning as harmless; others as attempted unauthorised access, particularly when it is systematic or when it precedes an intrusion. Meanwhile your internet provider's terms of service almost certainly forbid it outright, which can cost you your connection without anyone going near a court.

Practical rule: never scan an address you do not own or have written permission to touch. Scanning your own lab teaches everything a stranger's network would, and Nmap in depth is free with an account precisely so nobody has an excuse to practise on somebody else's infrastructure.

Where you can practise, legally

Your own lab. The best option by a wide margin, because you can break things properly. More on the build below.

Deliberately vulnerable applications and machines. Projects published specifically to be attacked, run locally on your own hardware. The classic web ones and the intentionally broken virtual machines are all designed for exactly this and cost nothing.

Training platforms with hosted labs. Purpose-built environments where the target is provided and the scope is unambiguous. Legal by construction.

Bug bounty programs, inside the published scope. These grant explicit, conditional authorisation through a safe harbour statement. Read the scope like a contract, because it is one: assets listed as in scope only, no denial of service unless permitted, no social engineering of employees unless permitted, no data exfiltration beyond proving the finding. Step outside those lines and the safe harbour evaporates.

Client engagements with a signed Rules of Engagement document. The professional version, covered in detail in our French article on Rules of Engagement.

What authorisation must actually contain

If you take one checklist from this article, take this one. A usable authorisation names:

1. The exact scope. IP ranges, domains, applications, accounts. Anything not named is out.
2. The window. Dates and hours during which testing is permitted.
3. The techniques allowed and forbidden. Denial of service, social engineering, physical access, exploitation of third-party services.
4. The signatory's authority. The person signing must actually own or control the systems. A developer's enthusiastic "go ahead" is not authorisation, and a hosting provider may need to consent separately.
5. The emergency contact and stop condition. Who to call, and what makes you stop immediately.
6. What happens to the data you collect. Storage, encryption, retention, destruction.

Verbal permission from someone without authority is the single most common way well-meaning people end up in trouble.

Building a home lab

The lab is where careers are actually built. A workable one, in order of value:

A hypervisor. VirtualBox or VMware on whatever machine you have. Sixteen gigabytes of memory is comfortable; eight is workable if you run targets one at a time.

An isolated network. Host-only or internal networking, so nothing you launch can reach the internet or your home devices. This is not optional — an exposed vulnerable machine will be compromised by someone else within hours, and it will be your address doing whatever they do next.

An attacker machine. Kali in a virtual machine, with snapshots. See what Kali actually is if you are about to install it as your main system, which you should not.

Targets that resemble reality. A vulnerable web application, a Linux server you deliberately misconfigure, and — the one that matters most for employability — a small Windows domain: a domain controller and two workstations. Most real compromises happen in Active Directory, which is why Active Directory Attacks has more practical value than another web tutorial.

Detection, eventually. Add logging and watch your own attacks appear. Seeing what your Kerberoasting looks like in an event log makes you better at both sides, and it is the reason Infrastructure Defense is free here alongside the offensive material.

The grey areas people get wrong

"The site is public, so scanning it is fine." Public availability grants you permission to use the service as intended, not to probe it.

"I found credentials in a public leak, so I can log in." Using leaked credentials against a live account is unauthorised access, full stop.

"It is my employer's system and I work in IT." Your job grants specific access for specific purposes. Security testing usually requires separate written approval from someone senior enough to give it. Ask, in writing, and keep the reply.

"The program said in scope, so its cloud provider is in scope." It is not. Third-party infrastructure belongs to a third party, and their consent was never given.

"I used a VPN, so it does not matter." Anonymity is not a legal defence, and it converts a conversation into an investigation.

Frequently asked questions

Is ethical hacking legal?

It is legal when you have documented authorisation from whoever controls the system, or when the target exists to be attacked — your own lab, a deliberately vulnerable machine, a training platform, or a bug bounty program’s published scope. Without that, the same actions are a criminal offence in most countries.

Is port scanning someone else’s network illegal?

It varies by jurisdiction and has been prosecuted as attempted unauthorised access in several. Your internet provider’s terms almost certainly forbid it regardless. Since scanning your own lab teaches the same skills, there is no upside to finding out where your local courts stand. The Nmap course is free with an account.

Can I get in trouble for reporting a vulnerability I found?

Yes, if you had no authorisation to look. Several well-publicised cases involved people who disclosed responsibly and were still prosecuted, because unauthorised access is the offence and disclosure came afterwards. Report through a published program with a safe harbour statement, or do not go looking.

What should a written authorisation include?

The exact scope as addresses and domains, the testing window, permitted and forbidden techniques, proof that the signatory controls the systems, an emergency contact with a stop condition, and how collected data will be stored and destroyed. Verbal permission from someone without authority protects nobody.

How do I build a hacking lab at home?

A hypervisor, an isolated host-only network, Kali as the attacker with snapshots, and targets: a vulnerable web application, a misconfigured Linux server and a small Windows domain. Keep the network isolated — an exposed vulnerable machine is compromised by strangers within hours, from your address.

Are bug bounty programs a safe way to practise?

Yes, provided you treat the scope as a contract. Test only listed assets, respect the forbidden techniques, and stop at proof rather than extracting data. Going outside the published scope removes the safe harbour that made your testing lawful in the first place.

Where to go next

Build the lab, then work through a real methodology rather than isolated tricks: the free penetration testing course starts with scoping and authorisation for exactly the reasons above, and ends with the report. Infrastructure Defense, also free, shows what your attacks look like from the other side.