Reading the scope & rules

Reading and respecting the scope is FIRST and most important: it defines what you can touch, how, and what happens if you go out. A brilliant bug out of scope isn’t paid and can cost you a ban —or legal trouble. This is the boundary between ethical hacking and a crime.

What the scope defines

In-scope       the assets you CAN test (domains, apps, APIs, ranges)
Out-of-scope   what you can NOT (sometimes specific assets, sometimes specific vulns)
Rules          which techniques are allowed and which are NOT
Rewards        the table by severity/type (bb-plataformas)
Safe harbor    legal protection if you respect the rules (key)

What’s usually PROHIBITED

- DENIAL of service attacks (DoS/DDoS) and aggressive fuzzing that degrades the service
- social engineering of employees/customers (unless explicitly allowed)
- physical attacks; spam; mass login brute force
- accessing/modifying/exfiltrating OTHER users' data (use your own test accounts)
- automation/scanning that generates excessive load
# breaking this = ban, no pay, and possible legal liability

Wildcards and limits

*.target.com    usually all subdomains... but WATCH for acquisitions/third parties
exclusions      sometimes a specific subdomain, a third party (SaaS), or an environment is out
third parties   a provider on the subdomain may be PROHIBITED even if it's *.target.com
# when in doubt, ask the program BEFORE testing

Before you start: due diligence

- read the WHOLE scope (in/out, rules, rewards, safe harbor) and re-read it
- confirm an asset you found in recon is actually in-scope
- identify if there's personal/production data -> extra care (and GDPR)
- save a copy of the scope/date: rules change

Minimizing impact when testing

- use your own TEST ACCOUNTS; don't touch real users' data
- a minimal PoC that demonstrates the bug without causing harm (don't delete, don't mass-scale)
- stop and report on sensitive data or unexpected access; don't escalate more than needed

Blue Team / ethical note

The scope is the legal boundary: inside = ethical hacking; outside = crime. Always re-read it.
Respect the rules (no DoS, social, others’ data) even if you technically can.
Minimal PoC and test accounts: demonstrate impact without causing harm or touching third parties.
When in doubt about an asset/technique, ask the program before acting.

Best practices and common mistakes

Read the entire scope before touching anything: domains, exclusions and forbidden tests (DoS, social engineering).
Respect safe harbor and stop the moment you reach real data; document and report without exploring further.
Common mistake: going out of scope “because I found something”; it’s the fast track to a ban (and sometimes legal action).

Testing checklist

Read the full scope (in/out, rules, rewards, safe harbor)
Confirm each recon asset is in-scope
Check prohibited techniques (DoS, social, mass brute force)
Use your own test accounts; don’t touch third-party data
Minimal PoC without causing harm
Stop and report on sensitive data/unexpected access
Save a copy of the scope (date); ask when in doubt