Tricky
Ooo! Forgive me being vague...
I once worked for a Big Company. Scammers would seek out vulnerable web servers and have them host a dummy site that was mad to look like Big Company. It would ask them (in the voice of Big Company) to input their details etc. It then would pass those details to the criminals.
Our job was to work with the server owners to have them sort their server's vulnerabilities and get them patched. In the process, they could remove the third-party software (scammerware!) and everyone would be happy.
Except...
Sometimes, server owners either refused to accept the word of Big Company (a huge multinational, I add), or they just ignored us. Either way, said scammer site would continue to operate - collecting personal data from OUR customers and clients - who would then complain to Big Company and threaten to take their business elsewhere. So, we had a strong interest in having server owners actually engage with us.
One such server's security was so lax, I decided to just delete the scammer's website folder and have done with it, because the server owner was telling us that we were wrong and they were perfect (I hope they eventually sacked their Head of Security, or webmaster). What I couldn't see, without being a little more heavy-handed, was how the scammer would re-spawn their website every time I deleted the files. After a bit of thought, I realised that as long as the folder and files existed, the respawn wouldn't happen. So, instead I edited the spanner's 'Big Company' look-a-like website to read things like, "We are scammers and not really Big Company and we are only seeking to steal your data and money," and other such warnings, as altered website text.
Job well done! Or so I thought...
When my bosses found out, they were horrified. Here in the - no, I won't say which country - I had left myself open to criminal charges of unauthorised access to a computer system. On top of that (and more importantly for Big Company), any attempt by me to mitigate would surely drag their name through the mud. In addition, there was a big question over THEIR implied authorisation to me regarding breaking said laws.
Our way out? Delete the site and have the thing respawn as the scammer intended and allow the scam to continue - despite the refusal of the server owner to even consider looking at their system.
Basically, what my experience taught me is that hacking (however good), seems fraught with legal pitfalls. While silent/stealthy access of a system to determine a lack of security is possible - progressing beyond that belief into testing precisely what can be done, is deemed a criminal act by some jurisdictions if not done with the permission, or invitation of the owner. I fail to see how such claims can be made without opening oneself to criminal proceedings.