Penetration Testing Methodology and Rules of Engagement
Structure a penetration testing engagement: pentest phases, scope definition, written authorizations, and drafting the rules of engagement.
4 hrs/week
🟦 Foundations · Cycle: 1. Planning HTB Academy: Penetration Testing Process
Objectives
- Define a penetration test and its phases.
- Plan an engagement in compliance with the legal framework.
- Produce a RoE (Rules of Engagement) and an engagement agreement.
What is a RoE (Rules of Engagement)?
The RoE (Rules of Engagement) is the contractual document that frames the engagement before it begins. It answers: What? When? How? How far? It specifies in particular the scope (which IPs/domains/apps you are allowed to test), the authorized and prohibited techniques (e.g., no denial of service), the time windows, the emergency contacts, and the handling of sensitive data.
Without a signed RoE, a pentester has no legal protection: the RoE plus the written authorization is what separates a legal test from a criminal offense.