Lab · Ethical Hacking and Penetration Testing (legal labs)
Lab: permission before you touch anything
The brief
Before any legal test there is paperwork: written permission, a clear scope and rules of engagement. You write a one-page authorisation and scope document for a practice engagement, then build a small Python guard that refuses any target outside the authorised range so you can never stray by accident.
Why it matters
In India, testing a system without the owner's permission can be an offence under the IT Act 2000 (sections 43 and 66). Professionals never start until a signed authorisation and scope exist. A scope guard is also how real teams stop a scan from drifting onto a neighbour's network.
Skills you practise
- authorisation and consent
- scope and rules of engagement
- the IT Act 2000
- CIDR scope checks in Python
You need
- Your own practice lab plan from module 2 (which VMs, which network)
What you will have at the end
authorisation.txt, a signable authorisation and scope document, and scope_guard.py, a tested check you run before every action.
How it is marked (rubric, 100 points)
| Complete authorisationEvery field is filled in, targets are specific, and forbidden actions and data handling are stated. | 45 |
|---|---|
| Scope guard worksin_scope and allowed pass every check, including the banned port and out-of-scope addresses. | 40 |
| Understanding the lawYou can say why written permission matters under the IT Act and what "scope creep" means. | 15 |
0/3 steps done
Step 1 of 3
Write the authorisation and scope
authorisation.txt is a complete, signable authorisation and scope document for your own lab engagement.
A real engagement starts with a document the owner signs. For your own lab you are both tester and owner, but write it as if for a client, so the habit sticks. Fill in every field in authorisation.txt: who is testing, who authorises it, exactly which targets (your lab IPs, such as 192.168.56.0/24), the dates and times, what you may do, what is off limits, an emergency contact and how any data found will be handled and deleted.
Your notes: authorisation.txt, scope_guard.py
Write down each command you ran. It goes into your project summary.