"Hey I hacked you, want me to fix it?"

Bad idea, don't try.

With Ransomware already going rounds, they will see you no different.

The most stupid clickbait ever...

Do it and you end in jail.

Honestly, if I read this anywhere and there was an easy way to file a complaint, I would! As has been said, it sounds like ransomware, spammers, scammers or real hacking. If you offer a genuine service, there are much better ways to market your business than skating on thin ice while holding a blow torch.

Lol, don't do that.

Search Google for bug bounties, solving those white hat problems will put you in front of businesses (publicity & $$) that want security help.

https://hackerone.com/bug-bounty-programs

Agree with the above. Bounties are good way to earn money and fame if you are skilled enough to break things. You get a decent background, you will receive calls from people who afraid of hackers as well.

The people who posted here are dumb, honestly. I've got a pretty big background in cybersec/infosec and the likes, have done some wargames, CTFs, and bug bounties (small ones, but bounties nonetheless.) You can very well do this, but there is a process to doing it.

You can do this. It's a field of grey-hat hacking, basically doing stuff that's technically illegal while maintaining good intentions. The trick is you need to know how to actually go about doing it.

First of all, if you're going to attempt anything remotely like this, check to see if the site has a bug bounty open. Use that to your advantage. Read their terms carefully, make sure you know what you're getting into. If there isn't anything you do, make sure you have two skillsets down: OPSEC/Anonymity, and your actual technical fundamental know-how when actually attempting the hack. These are for your own security, as well as the company.

The next part is to watch your limits. Find a vulnerability, try to leverage it if you really want (remember your OPSEC) but above all, report to the website owner that you found a vulnerability, no matter how small. Add some details on what the vulnerability is, how ti can be leveraged, this is where your marketing and communication skills are going to shine. Maybe make the vulnerability appear worse by giving the absolute worst-case scenario. Do whatever.

For legality, as long as you don't actually exploit the vulnerability, you're fine. But if you do, first notify the site owner, give them a response period of a few days to get back to you before you leverage the attack. 48-72hrs is usually pretty standard, but wait up to a week for the maximum security. If they respond, they might tell you to try and leverage the attack (with specific terms/conditions) as well as make you sign an NDA. If they don't, have a legal friend or come up with your own contract that will protect you in any case that you do try to leverage the attack, or that you won't disclose anything unless you can't leverage the vuln, etc. Protect yourself before screwing with someone's site.

If the site owner deems it's not serious enough to fix (say, a simple reflected XSS vuln on a site that doesn't even have a login, so no cookies to steal,) then don't touch it, respect their wishes, and move on.

I say definitely a bad idea. Business owners react adversely to internet hacking treats and you are likely to be spammed!

Of course it's a bad idea: will you let everyone who could force your door and come in your house to do it in exchange of a new door and also pay it?

You better go to upwork and post your expertise there, providing IT security services.

Is it a bad idea still if you do it this way:


Hey, I will hack your site. If I can get it, anyone can. If I can get it, I can stop others from doing so. If you're interested in finding out if you're at risk, I will proceed. If not, I wish you luck...


Get them interested in the idea, then hack?

You can tell them you found a vulnerability, but with all the scamming going on in this sector... It will be a hard sell

This is an interesting post...?

Is this real...?

So you're sitting at home alone in your underwear watching your favorite anime porn in the living room with a bag of cheese doodles leaving orange dust all over your clothes.

A smiling man comes up behind you, pats you on the shoulder, startling you so bad you scream and jump to your feet, knocking your cheese doodles everywhere and looking like a disgusting slob.

But no worries! He's here to help! He just picked your front door lock and snuck in, and he's offering to sell you a better lock. You thank him for helping you out and purchase his services, right?

Seems like you're trying to sell an anti-virus software? Something better would be:

"Detect the Undetectable." I mean, I'm not sure, but I know it's better than the one that's about to be attempted lol. You don't want to brag about hacking people, they'll either get mad at you or call the cops or both.

Good God please do not do this. Quickest way to either wind up in junk folders, killing your business, or to lose your reputation. Offer services not from fear or desperation but by being honest, genuine and high energy.

Bad idea!!

I will chime in on this topic!

The way that you worded this post, would make it illegal, and unethical hacking ...
There is a way around this, and I will get to that in a minute.

This is a VERY VERY common sales tactic, used in various industries, and has been for a very long time.

Create the problem, and offer the solution.
One example for the digital world ...

This tactic was used when paypal first came out, and they had flaws in their button code.
Some people picked up on this, and was able to gain access to your products, no matter the price, for only a penny!

That's when the first paypal payment protection script hit the market, and ofcourse it was open to affiliates.

So anyone who figured out how to "hack" the paypal button code, was now doing this, and sending out emails to the product owners stating they stole their products ...

Than offered the solution, the paypal protection software!

So yes, this has been done.

I mentioned it is illegal right?

So you have some hacking skills, that's good.
Remember I said, I had a way around those pesky laws that prevent you from doing this?
It's real simple....

ASK PERMISSION

That's contact the owner of the website, and inform that you are a website security expert and pentester, and believe their site probably has some vulnerabilities, and ask for permission to prove it to them, informing them that they can prevent this from happening.

Once you have their permission to pentest their system, it becomes completely legal, and ethical hacking.

Another example of an Industry doing this ...
Look into Halliburton and the Gulf oil spill!!!

Your idea is great, it just needs some tunning.

You can find flaws in systems but without actually exploiting them (only with the adequate permission), then present a report to the company, with info on the risks.

It's a great way to create the necessity in your potential client to later make a sale on correcting the flaws.

But never hack and then explaing because you could get into trouble.