> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/general/penetration-testing-faqs.md).

# Penetration Testing FAQs

## How to CYA (Cover Your Ass)?

In a penetration testing engagement, digital or physical, it's incredibly important to establish a Scope of Work (SOW). This document details everything from the IPs, URLs, SSIDs, CIDRs, facilities, and contacts with which you may engage with.

At the [Layer8 26'](https://layer8conference.com/talks/) conference, [Jesse Roberts](https://www.linkedin.com/in/jesse-roberts-b0aa73199/), the Senior VP at Compass Cyber Guard IT, discussed how keeping a physical copy of his SOW during engagements saved him an early trip to a jail cell after a bank branch engagement caught the attention of local authorities. He thoroughly emphasized the importance of ensuring that this document is signed by the appropriate authorities at the target company and by his company before ever starting a project.

{% hint style="info" %}
If you're ever in doubt, just reach out! Get written consent!
{% endhint %}

HackTheBox compiled this checklist of precautionary measures:

> * [ ] Obtain written consent from the owner or authorized representative of the computer or network being tested
> * [ ] Conduct the testing within the scope of the consent obtained only and respect any limitations specified
> * [ ] Take measures to prevent causing damage to the systems or networks being tested
> * [ ] Do not access, use or disclose personal data or any other information obtained during the testing without permission
> * [ ] Do not intercept electronic communications without the consent of one of the parties to the communication
> * [ ] Do not conduct testing on systems or networks that are covered by the Health Insurance Portability and Accountability Act (HIPAA) without proper authorization

## Penetration Test vs Red Team Assessment

**Penetration test**

The goal is coverage. You're trying to find as many vulnerabilities as possible within a defined scope (a network segment, an app, a set of hosts) and report on them so the organization can fix them. It's broad, systematic, and usually time-boxed against a checklist-style methodology (think OWASP, PTES, NIST). Stealth typically isn't the point — you're not trying to avoid detection, you're trying to be thorough. The deliverable is a comprehensive list of findings with severity ratings and remediation guidance.

**Red team assessment**

The goal is objective achievement, not coverage. You're given a specific goal (exfiltrate sensitive data, gain domain admin, reach the CEO's inbox, plant a flag on a critical server) and you use whatever chain of techniques gets you there, often including things outside a typical pentest scope: physical intrusion, social engineering/phishing, OSINT, lateral movement, persistence. Stealth usually matters a lot, because part of what's being tested is whether the organization's detection and response capability (the blue team) actually notices and reacts. You might walk right past ten exploitable vulnerabilities because they're irrelevant to your objective.

## Third Party Service Exceptions

Various third-party vendors may provide exceptions in the form of written statements, allowing penetration testers to engage with their products. For example, many companies utilize AWS, therefore, AWS has created a policy basically allowing security assessments on their infrastructure.

{% embed url="<https://aws.amazon.com/security/penetration-testing/>" %}

## Blackbox? Whitebox? Greybox?

There are multiple types of penetration tests one should be aware of:

| TYPE     | DESCRIPTION                                                                |
| -------- | -------------------------------------------------------------------------- |
| Whitebox | Given configs, credentials, source code, and details of internal structure |
| Greybox  | Given hostnames, subnets, URLs, and additional information                 |
| Blackbox | We're external attackers only provided the domains and IPs                 |

## Legal Know-How

{% hint style="success" %}
Feel free to use this [quizlet](https://quizlet.com/1190470454/key-us-and-international-cybersecurity-laws-regulations-flash-cards/?i=6txwjl\&x=1jqt) I made for studying cybersecurity regulations around the world!
{% endhint %}

### What is CISA?

The Cybersecurity Information Sharing Act, or CISA, is a 2015 U.S. law. It encourages private companies and the federal government to share cyber threat indicators and defensive measures. The goal is faster detection, analysis, and response to cyber threats. For penetration testers, this is legal background, not authorization. It does not replace a signed scope of work, written consent, or clear rules of engagement.

Do not confuse the law with CISA the agency. In this context, CISA refers to the Act.

[**https://www.cisa.gov/resources-tools/resources/cybersecurity-information-sharing-act-2015-procedures-and-guidance**](https://www.cisa.gov/resources-tools/resources/cybersecurity-information-sharing-act-2015-procedures-and-guidance)

### What is the Data Protection Act (DPA)?

The DPA is UK's data protection legislation, where anyone responsible for managing personal data must ensure the information is...

> * used fairly, lawfully and transparently
> * used for specified, explicit purposes
> * used in a way that is adequate, relevant and limited to only what is necessary
> * accurate and, where necessary, kept up to date
> * kept for no longer than is necessary
> * handled in a way that ensures appropriate security, including protection against unlawful or unauthorised processing, access, loss, destruction or damage

{% embed url="<https://www.gov.uk/data-protection>" %}