Ethical hacking is finding security bugs in places you're allowed to look, then reporting them to the people who can fix them. The skills are the same ones an attacker uses. The difference between security testing and breaking in is whether you had permission.
Who can give you permission?
Whoever owns the thing you want to test. Permission only ever comes from them, in writing, and testing a site without its owner's permission is against the law.
Some companies give that permission in public, usually through a bug bounty program or a published security policy. It says who can take part, what you're allowed to test and how to report what you find. You stay inside those rules, write up what you find, and their team fixes it. A page that only lists a security contact doesn't give you permission.
What does scope mean?
Scope is the list of what you're allowed to test. If something isn't on it, leave it alone, even when it looks related. A shop's checkout can be in scope while the staff login on the same website isn't.
When do you stop?
Once you've shown a bug is real, stop. Don't dig further, don't collect anyone's data, don't show it off. Write it up so it can be fixed.
That's the wording in the ethics agreement my students sign. Your proof has to be harmless, and one example that shows the bug is real is enough.
If you come across a real problem somewhere you haven't been given permission to test, don't test it.
A made-up example
This one is made up. moonmart is a practice shop built to be broken, and nothing in it is real. You only test where you have permission. The rules here: only test the lab, no real sites, use a harmless proof, and stop once you've proven it.
moonmart sells a sticker pack for $4.00. Its checkout page sends the price to the server, which is the part of the app that handles the order. You can change what the page sends, so you send a price of one cent and press Buy.
The page says "Order placed. Total: $0.01."
That's your proof, and that's where you stop. You don't place a pile of orders or go poking around the rest of the shop. The shop trusted the price you sent, and one order showed it. The server should have looked up the real price itself.
Why isn't finding the bug enough?
Right now you're the only person who knows about it, and you can't fix moonmart's server yourself. A finding nobody can act on isn't worth much.
A useful report gets someone else to the same spot without you. Compare these two:
Checkout bug. I changed the price and it worked.
I put the sticker pack in the cart, changed the price the page sends from 4.00 to 0.01 and pressed Buy. The order went through for one cent. The server charged the price the page sent, and it should look up the price itself.
The first one sends a developer off to look around. The second tells them what to try, what they'll see and what to change.
What this page can't tell you
This is a general explanation. It isn't legal advice, it can't tell you whether one specific test is allowed, and reading it doesn't give you permission to test anything.
My course is stricter than the general idea above. Students only test the practice apps inside BugClub HQ, never a real site, and they sign the ethics agreement before week 1.
If you want to try this on practice apps, the eight-week curriculum shows what each week covers, starting with a week on permission.