Intro

# RULES OF ENGAGEMENT (RoE) FIRST. ALWAYS.
# - Written authorisation from someone with authority to grant it
# - Scope (targets, environments, windows) agreed in writing
# - Allowed and disallowed techniques explicit
# - SOC notified; stop-test phrase agreed
# - Test data only; never real customer data
# - No destructive techniques, no detection evasion against systems you do not own

# ===== The phases (used defensively) =====
# 1. Reconnaissance  passive: public info, DNS, leaked docs (in scope only)
# 2. Discovery       active: ports, services, technologies (rate-limited)
# 3. Vulnerability   identify weak controls (NOT exploit, yet)
# 4. Exploitation    proof-of-concept in the lab to confirm severity
# 5. Reporting       evidence + remediation + verification steps

# Each phase emits artefacts that turn the engagement into hardening.

# ===== Toolkit landscape (defensive use) =====
# Recon:        amass, subfinder, dnsx, OSINT frameworks
# Network:      nmap, masscan, naabu
# Web:          Burp Suite (community), OWASP ZAP, ffuf, nuclei
# Wireless:     aircrack-ng (only your own networks!)
# Frameworks:   Metasploit, BloodHound (AD), Caldera (purple team)
# Reporting:    Markdown templates + screenshots + pcap excerpts

# ===== Defensive mindset =====
# Every attack technique you learn maps to:
#   1. A detection rule (Sigma, EDR, Wazuh)
#   2. A hardening control (config, code, policy)
#   3. A user education or process change
# A good ethical hacker is a blue-team multiplier, not a trophy hunter.

# ===== Where to practise legally =====
# - HackTheBox, TryHackMe, OverTheWire, PortSwigger Web Security Academy
# - DVWA, WebGoat, Juice Shop (self-host)
# - Bug bounty programs (read scope CAREFULLY before testing)
# - CTF competitions (DEF CON, picoCTF, GoogleCTF)

# ===== Certifications worth knowing =====
# OSCP    practical penetration testing
# eJPT    entry-level pen tester
# PNPT    practical network pen tester
# CRTP    Active Directory
# AWS Certified Security  cloud-specific
# CISSP   broader infosec management

# ===== When ethical hacking wins =====
# - Validating that controls actually work
# - Hardening before adversaries find the gap
# - Training engineers via realistic scenarios
# - Compliance (PCI, ISO, SOC 2) often require it

# ===== When it hurts =====
# - Testing without RoE -> legal risk + relationship damage
# - Findings without remediation paths -> reports that gather dust
# - Burning trust with the SOC by triggering false incidents

# ===== Patterns to internalise =====
# - RoE first; no test, no exception
# - Pair every offensive note with a detection + hardening control
# - Lab only; never on prod or third-party services without scope
# - Reports are deliverables, not brag sheets

# ===== Pitfalls =====
# - Verbal scope changes -> confirm in writing
# - Sharing payloads publicly without redacting
# - Skipping the hardening half of the report
# - Letting the engagement drift into disallowed techniques during an exciting lead

# Ethical hacking = legal, authorised security testing of systems you OWN
# or are CONTRACTED to test. Bug bounty programs grant in-scope permission.
# Everything else: ask first, get it in writing, document scope.