You can't just start doing pentests on any website/service you encounter.
Of course you can.
Justice takes "intent" into account. It's not against the law to break into a house unless you intend to do something illegal.
If he doesn't want visitors to his website, he should take it offline.