I know some jurisdictions treat hacking tools the same as burglary tools, which is really dumb if you're just trying to test your own system's security.