pentest-scope

Overview

Based on Penetration Testing (Georgia Weidman) and The Hacker Playbook 3 (Peter Kim). A pentest scope document defines the contract between the organization and the tester: what systems can be tested, by what methods, during what window, and what is off-limits. Without a signed scope document, testing is unauthorized access. The scope doc protects both parties.

Weidman's rule: vague scope produces vague findings. The tighter and more specific the scope, the more actionable the results.

Workflow

Step 1: Write the engagement header