It has been shown time and time again it’s not ethical. And if you discover a flaw, then they’ll likely nail you to the wall if they don’t mind the publicity. When you do any sort of security testing, make sure you have permission in writing from someone with the authority to give it. Why?
See Randal L. Schwartz. He fought the conviction for 12 years and finally had his record expunged. He was doing something most sysadmins at the time wouldn’t have thought twice about. But convicted he was.