Foundations & Mindset
Ethics, Law & Rules of Engagement
Scope, authorization, and staying on the right side of the law.
Before any legitimate test, both sides sign a document defining the Rules of Engagement (RoE): what you may test, when, how aggressively, and what is off-limits.
- Scope — exact domains, IP ranges, and apps you're allowed to touch. Nothing else.
- Timing — allowed testing windows (some tests can disrupt production).
- Excluded actions — e.g. no denial-of-service, no social engineering of staff.
- Emergency contacts — who to call if you break something or find a live breach.
Practice legally, for free
- HackPath's built-in labs (fully local, safe).
- Intentionally vulnerable apps you run yourself: OWASP Juice Shop, DVWA, bWAPP.
- Legal online ranges: TryHackMe, Hack The Box, PortSwigger Web Security Academy, PentesterLab.