Skip to content

01-scoping.md

Latest commit

 

History

History
51 lines (36 loc) · 2.71 KB

01-scoping.md

File metadata and controls

51 lines (36 loc) · 2.71 KB
Raw

01 — Scoping

Day-zero work that decides how much value the engagement delivers.

Confirm in writing before you touch anything

  • Authorised targets: every URL, IP, and /24 — no implicit "anything that resolves" coverage.
  • Out-of-scope: third-party SaaS, social engineering, DoS, anything cloud-provider-managed.
  • Test window dates and times. Off-hours? Production? Staging only?
  • Lockout policy and rate-limit awareness. Do not start password spraying without a written-down per-hour budget.
  • Authorisation letter / SoW reference. Save the PDF in your engagement folder.
  • Emergency contact (client side) for "we just took something down" moments.
  • Reporting deliverables — PDF? DOCX? Retest scope? SLA on findings disclosure?

Banner agreements

If your scope includes anything customer-facing, agree on banner content. The DDoS finding nobody wants is the one your scanner triggered against a CDN that interpreted it as DDoS.

Account access

  • Two accounts at every privilege tier (so IDOR/horizontal tests have a real comparison).
  • At least one admin if the SoW grants admin testing.
  • MFA shared via a tool the client trusts (Bitwarden / 1Password).
  • Test data: pre-loaded transactions, dummy customers — so you have realistic state to abuse.

Environment readiness

  • VPN access tested before kick-off.
  • Source IP whitelisted for the scope.
  • You know which proxy / collaborator domain you'll use (Burp, interactsh) and that egress works to it.
  • You've spun up a clean engagement folder via newpentest <client> (or your own scaffold).

Data handling

  • Encrypted disk on the test laptop.
  • Findings + evidence go to the client-named folder, never /tmp.
  • No raw PII in screenshots; redact or replace before report.
  • You know the data-destruction expectation post-engagement.

What you tell the client (in plain English)

"I will run automated and manual tests against the in-scope assets between these dates. I will pause and inform you if I find anything that's actively impacting users or could lead to data exposure if I escalate further. I will not test out-of-scope items. The retest covers issues from this report only."

Common scope traps

Trap Mitigation
Wildcard "*.client.com" Pin specific subdomains in scope; ask explicitly about new ones discovered during recon.
Shared infra with other tenants Confirm whose tenancy you're allowed to test before SSRF/SSTI escalation.
"Just like last year" Get a fresh authorisation. Last year's letter doesn't cover this year's pentester or environment.
Mobile app + API Scope both explicitly — testing the API alone misses client-side bugs.