Penetration Testing

Treat written authorization and a precise rules-of-engagement document as prerequisites. If ownership, scope, or permission is unclear, stop before active testing and help define the engagement. Educational practice must use an intentionally vulnerable lab or CTF target.

Authorization Gate

Record and verify:

• authorizing organization and named contact;
• in-scope domains, IP ranges, applications, APIs, accounts, and environments;
• explicitly excluded assets and third parties;
• allowed techniques and maximum request/concurrency rates;
• test window and time zone;
• test accounts and data handling requirements;
• emergency contact and stop signal;
• outage, data modification, social engineering, physical access, and denial-of-service rules;
• evidence retention and destruction policy.

Authorization to assess one asset does not extend to connected services, cloud tenants, employees, vendors, or discovered infrastructure.