The single thing that separates ethical hacking from a crime is authorization. Read this before anything else on this wiki.
The non-negotiables
Get it in writing. Verbal permission is not enough. You need signed, written authorization that names the scope, the testers, and the dates before any testing begins.
- Only test what you own or are authorized to test. Home labs and CTF platforms (HTB, TryHackMe, ApeXLabs HACK) grant authorization by their rules — read them.
- Unauthorized access violates laws like the US CFAA, UK Computer Misuse Act, and equivalents worldwide — even "just looking."
Rules of Engagement (RoE)
| Item | Define before testing |
|---|---|
| Scope | Exact IPs/domains in and out of scope |
| Timing | Allowed dates/hours, blackout windows |
| Methods | Allowed? (DoS, phishing, social eng.) |
| Data handling | What you may access/exfiltrate, how it's stored |
| Contacts | Who to call if something breaks |
| Get-out-of-jail | Signed authorization letter on hand |
Responsible disclosure
If you find a vuln outside an engagement (e.g., a bug bounty or by accident):
- Stop — don't exploit further than proving it exists.
- Report privately to the owner / security contact (
security.txt, bug-bounty program). - Give reasonable time to fix before any public disclosure.
Bottom line: no scope, no test. Every offensive page here assumes you have explicit authorization.