FREE Hacking & defense LESSON · Hacking & defense
Scope before technique
Authorization, hypotheses, and safe evidence
Permission is part of the technical method.
A legitimate test has a named owner, written scope, permitted techniques, time window, data-handling rules, stop conditions, and escalation channel. Begin with a hypothesis about a boundary or invariant. Collect the minimum evidence needed to confirm it, avoid persistence or unnecessary data access, and preserve a reproducible log.
Capability never expands authorization.
A scanner result is not a vulnerability argument.
Tools produce observations and guesses. Validate the affected asset, precondition, reachable path, violated property, and realistic impact. False positives waste trust; excessive proof can create harm. A strong report shows the minimal reproduction, root cause, fix direction, and evidence that the fix closes the path.
The report should teach the owner why the boundary failed.