Mostly harmless, conspicuously useful

The Hitchhiker's Guide to Becoming a Penetration Tester

A penetration tester is paid to break things within an agreed scope, which is a perfectly reasonable arrangement except that the scope is a contract both sides interpret differently, the report is read for the executive summary and ignored for the remediation, and "social engineering" is the polite term for the users, who are, statistically, the perimeter. You learn to translate "can you see if we are secure" into a rules-of- engagement document, a reconnaissance pass, an exploitation plan, a scope clock, and a findings report whose severity the client will renegotiate downward until the headline is acceptable and the risk remains. The adversary breaks things without paperwork; you break them with paperwork, which is the entire difference and also the reason the client is paying. This guide travels from reading a scope document without flinching to leading red-team operations across an estate, with practical stops at reconnaissance, exploitation, web applications, networks, the users, scripting, reporting, and the recurring discovery that the easiest vulnerability is the one someone installed and forgot. The grand objective is to find the weaknesses before the adversary does; the daily evidence is usually a documented finding, a tested exploit, and a remediation the client reads about, agrees to, and refers to in the retrospective as something we should probably look at next quarter.

Things to recognise

• A scope written loosely is a scope the client will interpret narrowly after the finding, and the tester will interpret broadly before it; agree on the specific hosts, methods, and hours in writing, or the retrospective will invent them.
• Active reconnaissance touches the target and is therefore within scope or outside the law; a packet sent without authorisation is a packet sent at one's own legal expense.
• The code of ethics is not decorative; a finding obtained outside scope is inadmissible, and a tester who reports it has confessed to exceeding the rules of engagement in writing.

Take the useful exit

Level 1 · Novice

Read the scope before the scope reads you in court

You inspect rules of engagement, scope documents, authorisation letters, and public attack surfaces without sending a packet, learning how a perfectly polite reconnaissance pass can collect a small fortune in legal exposure before you finish reading the exclusions.

You begin with read-only artifacts: rules of engagement, scope documents, authorisation letters, the code of ethics, public records, and a target list pre-approved by the client. Scoping and ethics is the practice of defining what may be tested, by whom, when, and with what limits, and operating strictly within those limits; reconnaissance is the mapping of an attack surface through passive and active information gathering. Passive reconnaissance uses sources the target cannot detect — DNS records, certificate transparency logs, archived pages — while active reconnaissance touches the target and is therefore within scope or outside the law. You review these with an experienced tester, the client's contact, and the letter of authorisation so that the gap between "what we may test" and "what looks interesting" becomes a written decision rather than an enthusiastic packet.

Suppose a client approves testing of "the public web application" and you discover, during passive reconnaissance, that the same hostname hosts an administrative portal the client forgot existed. In a read-only review, you record the portal, its relationship to the approved scope, and the assumption you will need clarified before touching it. You change nothing. The portal is reachable from the internet, which the client does not remember arranging, and the rules of engagement do not mention it. Testing it anyway would be efficient in the manner of a tourist who repaves a road without checking whose road it is, and the resulting letter would be from a lawyer rather than from a satisfied customer. One annotated question is an observation with good posture; the scope amendment belongs to the client, who has not yet been told they own the portal.

Words from the spaceship manual, translated

Rules of engagement: The written agreement defining scope, timing, methods, contacts, and limits of a test. It is a contract both sides interpret differently, which is why it must be specific enough that the interpretations have nowhere to hide.
Authorisation letter: A document, signed by an accountable client authority, granting the tester permission to act against the scope. It is the difference between a penetration test and a crime, and it is the document the tester reads aloud to themselves at three in the morning.
Passive reconnaissance: Information gathering from sources the target cannot detect — public DNS, certificate transparency, archived snapshots, job postings. It is the reconnaissance that does not require a scope amendment, because the target does not know it happened.
Attack surface: The set of points where an attacker could touch a target — hosts, services, applications, accounts, documents. It is not a number; it is a map, and the parts no one has drawn are usually the parts that matter.