Background: I remember when I was still in college here in the Philippines, one of the member of the school thesis committee tries to hack my system by injecting some kind of code (I am not sure but I think this is SQL injection). Now that I am working I realized that it is illegal to just hack and get inside of the system. This hacking includes breaking into the security of the system then extracting the datas (some are dummies only and some are original). He said that he do this to prove that our system has not enough security and therefore concluded that it is not safe to use, due to this my team has been subjected to re-defense. Also, there are no proper discussions whether he has the authority to get inside the system, I also don't know the privileges of the panelist.

Please take note that the computer we are using is ours (students) then the panelist are obliged to test the system for certain minutes only (maybe 5 minutes). Also, we didn't use any ISP because it is only a system together with it's database and therefore can be use offline.

During that time we've been subjected to re-defense simply because our system is not secured.

Question: Does hacking the system just to prove that it lacks security and therefore not safe to use, still ethical? Considering that we are on a thesis-defense and are still a learner. Our knowledge cannot be compared to a professional that is expert in system developing.

Update as of September 17, 2014

Thank you so much for so many answers! I'll update this to help the future visitors.

I chose Nahkki's answer because of the following reason:

1. It specifically tells something about the policies of software testing which I find helpful when answering questions like this.
2. The approach is for student and inside the academy.