If you want to try that route, there's an ethical way: look for companies with vulnerability disclosure programs on HackerOne or Bugcrowd.

Being well-written in your interactions with companies on those platforms would go a long way in improving your credibility.

Sign up here: https://www.hackerone.com/resources/hack-learn-earn

Sign Up here - https://bugcrowd.com/user/sign_up

Not only is hacking them illegal, but trying to sell them services after that could easily be seen as an attempt at blackmail. It's a profoundly bad idea.

Almost certainly no. If they have a bug bounty program they will pay out through that, but attacking a company of any sort that does not have an open program is a good way to get prosecuted.

I've done this long ago to one of the companies I had worked for before – as in pointing out major holes, not taking over anything – but I think it's not a good idea if you don't have any previous relationship at that company and don't know anybody there. It's a huge risk. It doesn't give people a good feeling to be criticised, or to notice others are sneaking around their livelihoods... Imagine someone sneaking around your car to check if any doors are open. Even if you just want to helpfully point something out, you have given people a bad vibe that is surely not going to help you to get hired.

I'm a security analyst at an MSSP with hundreds of large companies as customers. The typical response would be to press charges and try to send you to prison.

What if you beat up a person, lightly, to show them they are weak, and then offer your body building / fighting training, do they hire you? :)

Well in that case, unrecoverable damages are caused whereas in many ways you can hack - or penetrate - without causing any damage. I guess.

What if you break into someone's home at night, unnoticed and ask if they want an advice on how to stay safe, do they hire you? No damages made!

A more accurate analogy is that you contact the home owner and advise them that their home is at risk of being broken in to because of whatever security they're lacking. No need to actually break in to the home, just point out the vulnerabilities.

Okay but you need to check if they are vulnerable. I think the owner wouldn't be happy with people fiddling with his locks to check if he is vulnerable.

The correct solution is the same as for pentesting: ask for permission first.