In your agreement followed by a statement absolving

in your agreement, followed by a statement absolving your team from unintentional problems,
then, yes—congratulations—you’re accountable.
Want another one you should think about? Try worrying about what actions your target
takes when they see you. If a network admin shuts everything down because he thinks they’re
under attack and that causes fill in the blank, are you at fault? You may be if you don’t have a
clause that reads something like the following:
The actions taken by the target in response to any detection of our activities are also
beyond our control…
What happens if a client decides they don’t want to accept that clause in the agreement?
Well, since there’s absolutely no way to guarantee even the calmest of pen test tools and
techniques won’t alter or even destroy data or systems, my advice would be to run. Just
because toolsets and techniques are designated passive in nature, and just because they aren’t
designed to exploit or cause harm, don’t believe you can just fire away and not worry about it.
And just as facts don’t care about feelings, tools don’t give a rip about your intent. Get your
agreement in order first, then let your tools out on Spring Break.
NOTE The Computer Fraud and Abuse Act (1986) makes conspiracy to commit hacking a
crime. Therefore, it’s important the ethical hacker get an ironclad agreement in place before even
attempting basic footprinting.
While we’re on the subject of using websites to uncover information, don’t neglect the
innumerable options available to you—all of which are free and perfectly legal. Social
networking sites can provide all sorts of information. Sites such as LinkedIn
( ), where professionals build relationships with peers, can be a great place to
profile for attacks later. Facebook and Twitter are also great sources of information, especially
when the company has had layoffs or other personnel problems recently—disgruntled former

employees are always good for some relevant company dirt. And, just for some real fun, check
out to see just how powerful social networking can be
for determined hackers.
EXAM TIP You can also use alerting to help monitor your target. Google, Yahoo!, and
Twitter all offer services that provide up-to-date information that can be texted or e-mailed to
you when there is a change.
Google Hacking
A useful tactic in footprinting a target was popularized mainly in late 2004 by a guy named
Johnny Long, who was part of an IT security team at his job. While performing pen tests and
ethical hacking, he started paying attention to how the search strings worked in Google. The
search engine has always had additional operators designed to allow you to fine-tune your search
string. What Mr. Long did was simply apply that logic for a more nefarious purpose.