As pentester can we exploit any vulnerability regardless of the affectations?

Penetration testing is governed by strict legal and ethical principles. All testing activities, especially the exploitation of vulnerabilities, must be preceded by explicit, written consent from the target organization. This authorization is formalized in a contract and a "Rules of Engagement" document, which defines the scope and limits of the test. Performing such acts without consent is a criminal offense under laws like the Computer Fraud and Abuse Act (CFAA) in the U.S. and similar legislation worldwide. Therefore, a pentester's actions are strictly bound by the law and the authorized scope of the engagement.

A. YES, we have all the freedom: This is incorrect. Pentesters operate under strict legal and contractual constraints, not with absolute freedom.

C. YES, we have all the power to perform these processes without consent: This is false and illegal. Acting without consent is a crime, not a professional privilege.

1. Scarfone, K., Souppaya, M., & Orebaugh, A. (2008). NIST Special Publication 800-115: Technical Guide to Information Security Testing and Assessment. National Institute of Standards and Technology. Section 2.2, "Establishing the Assessment Rules of Engagement," emphasizes the necessity of a formal agreement before testing. DOI: https://doi.org/10.6028/NIST.SP.800-115

2. Graves, K. (2010). Official Certified Ethical Hacker Review Guide. Cengage Learning. (Used as a textbook in university curricula). Chapter 1, "Introduction to Ethical Hacking," explicitly states that the key difference between hacking and ethical hacking is obtaining permission.

3. Stanford University. (n.d.). CS 182: Ethics, Public Policy, and Technological Change. Course Syllabus. Stanford, CA: Stanford University. Courses of this nature in reputable institutions cover the legal and ethical necessity of consent for actions that affect computer systems.