This question already has an answer here:
A person indulged in the negative aspects of information security (social engineering, active information gathering etc.)
- Should he reference these experiences in his CV
- And if so, how should he reference it?
The debate about the legality and morality of the mentioned actions will be irrelevant here and out of the scope of the argument.