Hypothetical situation:
before I hire a web development company I want to test their ability to design secure web apps by viewing their previous client's websites.

Issue:
this situation raises a big red flag: with regards to viewing a website, what is and is not within the breadth of the law? Or in other words: at what point does poking around a website become illegal?  


View Source with Firebug? Naturally that would be legal.
But what if I change HTML (like a hidden form value before submission)?
Perhaps I then edit or remove JavaScript, like a client side validation script. Would that be legal?
What if I put %3Cscript%3Ealert(1)%3C/script%3E at the end of the URL. 
Or perhaps I type the URL: example.com/scripts/ and I'm able to view their directory due to faulty permission settings?
What if I manipulate data passed in HTTP headers, for instance a negative product qty/price to see if they do server side validation (naturally, I wont complete the checkout).


To me, all of this seems perfectly harmless because:


I'm not causing undue stress to their server by spamming, mirroring the site with wget, or injecting potentially dangerous SQL.
I'm not causing any potential loss or monetary damages, because I wont ever exploit the vulnerabilities, only test for their existence (proof of concept).
None of my actions will have any implication for user data privacy. In no way would any of my actions potentially reveal confidential or private information about anyone.
If I did find anything I would immediately notify the webmaster of the potential exploit so they could patch it.


But even though I am logically able to justify my reasons for testing the site, that does not necessarily make my actions legal. In fact, cyber laws are notoriously backwards in the United States, and even the most laughably trivial actions can be considered hacking.

Questions:
Is there a defined line in the sand that separates illegal hacking from "testing without permission"? Or is this whole scenario a grey area that I should avoid (likely the case). Are there any linkable online resources that could expand my knowledge in this wholly grey area? What are the specific acts or laws that handle this?

Please keep in mind that the number one most logical choice would be to simply: ask for permissions. However, due to heavy time constraints, by the time I would get permission it would all be for naught.

Don't do it!  Don't do it!  If you are in the US, the law is very broad.  You don't want to even tiptoe up to the line.

The relevant law is the Computer Fraud and Abuse Act (18 U.S.C. 1030).  In a nutshell (and simplifying slightly), under the CFAA, it is a federal crime to "intentionally access a computer without authorization or exceed authorized access".  This language is very broad, and I imagine an ambitious prosecutor could try to use it to go after everything on your list except #1 (view source).

Orin Kerr, one of the leading legal scholars in this area, calls the statue "vague" and "extraordinarily broad", and has said that "no one actually knows what it prohibits".

And, as @Robert David Graham explains, there have been cases where folks were prosecuted, threatened with prosecution, or sued for doing as little as typing a single-quote into a textbox, adding a ../ to a URL, or signing up to Facebook under a pseudonym.  It's pretty wild that this alone constitutes a federal offense, even if there is no malicious intent.  But that's the legal environment we live in.

I'd say, don't take chances.  Get written authorization from the company whose websites you want to test.
