Lesson 1 — Permission comes first
Ethical testing requires clear authorization from the system owner. Permission should identify the systems in scope, allowed methods, timing, and who to contact if something goes wrong.
Lesson 2 — Scope and rules of engagement
Read the rules before starting. Stay within the approved assets and techniques. Stop if you encounter sensitive data or an unexpected impact, and follow the owner's reporting process.
Lesson 3 — Reconnaissance fundamentals
Reconnaissance is collecting information relevant to an authorized assessment. Start with documentation and public information about your own lab, and avoid collecting private information about people.
Lesson 4 — Practice in a legal lab
Use intentionally vulnerable training environments, local virtual machines, or learning platforms that explicitly authorize testing. Keep lab systems isolated and avoid testing public systems without permission.
Lesson 5 — Write a useful report
A good report explains the issue, impact, affected in-scope asset, safe reproduction details, evidence that avoids exposing secrets, and a practical fix. Be clear and respectful.