Typorithm · easy

Rules of Engagement & Scoping

roe-scopingpentestscopeauthorizationroe

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Rules of Engagement & Scoping

Engagement

A penetration test is only legal with explicit written authorization. The statement of work plus rules of engagement define which assets are in scope, when testing may happen, which techniques are allowed, and who to call if something goes wrong. Touching anything out of scope is illegal.

Before any testing begins, you need a signed authorization: a statement of work that names the in-scope targets and rules of engagement that describe what, when, and how you may test. This document is what makes the difference between a sanctioned assessment and unauthorized access.

Scope is sacred. The contract lists the exact IP ranges, domains, and applications you are allowed to touch. Anything not on that list — a neighbour's host on shared infrastructure, a third-party service, an asset the client does not actually own — is off-limits, and probing it can be a crime regardless of intent.

Always agree timing, stop conditions, and an emergency contact up front. The client should know your testing window so they don't mistake you for a real intruder, and you need a named escalation path to call the moment you risk an outage or stumble onto evidence of a prior breach.

Signed written authorization is mandatory before any testing.

Scope lists the only assets you may touch; out-of-scope testing is illegal.

Agree timing, stop conditions, and an emergency contact in advance.

engagement:
  authorization: signed-written-contract
  scope: in-scope-targets-only
  rules_of_engagement: allowed-techniques
  timing: agreed-window
  emergency_contact: escalation-path

Read the implementation

Connect each part of the code to the concept before you type.

1. Written authorization

A signed contract — not a verbal okay — is the legal basis that separates an authorized test from a crime.

authorization: signed-written-contract

2. Defined scope

Scope names the exact assets you may touch; anything outside it is off-limits, full stop.

scope: in-scope-targets-only

3. Rules of engagement

The RoE spell out which techniques are permitted (and which are forbidden, like denial-of-service).

rules_of_engagement: allowed-techniques

4. Testing window

An agreed window tells the client when testing happens so they can distinguish you from a real attacker.

timing: agreed-window

5. Emergency contact

A named contact and escalation path lets you stop immediately if something breaks or you find a live compromise.

emergency_contact: escalation-path

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.