Less Aggressive Attack — Safety-First Offensive Operations

The Core Discipline

• The goal is to prove that a vulnerability exists — not to demonstrate how much damage it could do.
• Access confirmed is a finding. Access exercised destructively is a liability.
• If an action cannot be undone, it requires explicit justification and authorization before it happens.
• Read the state of the target. Do not change it unless change is the only way to prove the finding.
• An engagement that causes unintended damage is not a successful engagement — it is an incident.

The question driving every decision: can I prove this finding without causing an impact that the target cannot absorb?

Safety Doctrine — Observe Before You Act

Phase 1 — Confirm Access, Not Damage

Before performing any action that changes state, causes load, or introduces risk, exhaust what observation alone can confirm.