Ethics, the law, and scope

02Read all the boundaries

The target names the specific system, file or account covered. The allowed action says what you may do. A time window gives the start and end of the permission. Exclusions name things the permission does not allow. Check these together; matching only the target is insufficient.

A stop condition says when to pause even if the original activity was permitted. For example, a file might reveal private information. Stop investigating that material and follow the agreed reporting instructions rather than copying or exploring it further.

A grant is a statement that gives permission. Rules of engagement are more detailed instructions and limits agreed before a test. NIST SP 800-115 includes a template for them. The short notes here practice reading boundaries; they do not replace a real organization's authorization process.

A port scan checks which numbered network service endpoints, called ports, respond on a system. You will learn the technical method later. Here, recognize scanning as a different action from reading a page. The diagram below sorts the demo-page exercise into three decisions: within permission, outside permission, and pause to clarify. Read its target, action and time together. The practice note later supplies the full details; the diagram itself is a model to reason about, not a service to visit.

03Permission must come from the right place

A friend who uses a service may not have the right to authorize testing it. Having an account gives you access under that service's terms; it does not automatically allow security experiments.

For a service operated by someone else, look for written permission from the responsible owner that covers your activity, or an official testing program whose published rules cover it. Such a program defines permitted testing on the owner's behalf. Check its targets, actions and conditions before proceeding.

Owning your laptop does not give you control over every service it contacts. A school portal or another person's account remains outside your local lab's permission. A CTF result also supplies no permission to test a real service.

04Check three requests

Start with this invented page-reading exercise. Compare reading, scanning and changing files as different actions, even when they concern the same target.

The note uses 24-hour times: 14:20 is after 14:00 and before 15:00, while 15:30 is later than the window. Treat them as times in the same fictional exercise, not appointments for you.

FICTIONAL PERMISSION NOTE
Owner: training-lab owner
Target: supplied demo-page
Allowed action: read the displayed lesson page
Time: 14:00–15:00 in the same stated exercise time zone
Excluded: port scanning, edits and unrelated pages
Stop: disruption, private information or uncertain permission

REQUEST 1: read demo-page at 14:20
REQUEST 2: scan ports of demo-page at 14:20
REQUEST 3: read demo-page at 15:30

These are invented requests to classify, not actions to perform.

1. Copy the target, allowed action, time window, exclusions and stop conditions into separate lines in your notes.
2. For each request, compare its target, action and time with the note. Record the specific boundary that supports your decision.
3. Check your reasons: Request 1 matches the page, action and time. Request 2 uses an excluded action. Request 3 proposes a permitted action after the window has ended. The target alone cannot settle all three.
4. Now change only the time line to this afternoon. Draft a question asking for the missing start, end and time zone. Stop with the private draft; do not make connections or send requests.

05Read the file-based permission note

The checks at the end use Permission note B, a different invented case involving files. A VM is a virtual machine: a computer environment created in software. lab-notes is its name in this case. You do not need to build it or enter commands to answer the checks.

A folder groups files. A path describes a location using names separated by slashes. In this note, /srv/notes is the permitted folder, and /srv/notes/todo.txt names a file inside it. /etc/hosts names a different location outside that folder. You only need to compare those locations; their real system purposes are taught later.

List means view the names in a folder. Read means view a file's contents. Edit means change them. The note allows listing and reading within the named folder but excludes changes, locations outside it and scans. UTC names a shared time standard. All requests in that note use UTC, so compare their times directly with Saturday 10:00–12:00.

Read each request against every relevant boundary, including the stop condition. If personal data such as home addresses appears, the note tells you to pause and report, even if the file location and time otherwise fit. Use the new note's own details rather than copying the earlier page exercise's times.

06Law and responsibility

Legal requirements depend on the jurisdiction, system and activity. This course cannot decide whether a real test is lawful. Its fictional permission cards are practice in reasoning, not legal authorization for an actual target.

For course practice, use the supplied exercises or explicitly authorized labs within their stated limits. Before real organizational testing, the responsible owner and relevant policies must resolve permission questions. If you lack a required boundary, stop and clarify it rather than inventing one.

07Module check: a puzzle has boundaries

Combine the four lessons in this module in a short fictional case. Choose a CTF card, name an asset and a possible harm, and describe one proposed test. Write which permission line covers the action and which systems remain excluded.

Review your note: the proposed action should match the target and limits, and any missing information should remain a question. Explain why solving the puzzle would not authorize testing its scoreboard. Keep the case written; no tool use or external activity is needed.

08Optional challenge

Allow about 5 extra minutes. Draft two questions for an unclear permission note: one about its start, end and time zone, and one about whom to notify if private information appears. Explain which uncertainty each question resolves. Keep the draft private.

09Cards for the checks

The checks below use these cards. They are original fictional text, safe to read anywhere.

1PERMISSION NOTE B
2Owner:    course lab owner
3Target:   a fictional practice VM named lab-notes
4Allowed:  list /srv/notes and read files inside it
5Time:     Saturday 10:00-12:00 UTC
6Excluded: changing any file, reading outside /srv/notes, any scan
7Stop:     a file holds personal data, or something stops working
8 
9R1  list /srv/notes                    Sat 10:15 UTC
10R2  read /srv/notes/todo.txt           Sat 12:30 UTC
11R3  edit /srv/notes/todo.txt           Sat 10:20 UTC
12R4  read /srv/notes/staff.txt          Sat 11:00 UTC  (it lists home addresses)
13R5  read /etc/hosts                    Sat 10:40 UTC
14 
15Read this card only; no VM or file access is required.

10Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

Owner: lab owner. Target: supplied archive-page. Action: read the page. Time: 09:00–10:00 UTC on the same fictional day. Excluded: edits, scans and other pages. Stop: unexpected private information or unclear permission.
Request P: read archive-page at 09:20 UTC.
Request Q: edit archive-page at 09:20 UTC.
Request R: read archive-page at 10:15 UTC.

Same owner supplies a separate grant: read index-page from 13:00–14:00 UTC; scans and other targets excluded. Proposal: scan other-page at 13:30 UTC. No actions are performed.

11Write the permission decision

Optional written self-check: State the target, action, time and exclusions, then justify a permitted replacement. If private information appears or a required boundary is missing, pause and draft a clarification through the agreed channel. These fictional grants do not authorize real testing or settle real legal questions.