Roe
Rules of Engagement
This is a document that you will have to sign with the client after the quote and they sign the master of service agreement. The quote and master of service isn’t important to you. You will only be concerned about the rules of engagement.
The rules of engagement defines the roles and responsibilities and the details of the test agreement. It will tell you what you can and can’t do.
Contents
- Dates of the test
- Disclosure
- Status updates
- External Penetration test
- Malware test
- Cobalt Strike, Meterpreter
- Bounds of the test
- Stop Point
- Keeping Access
- Announcement
- Project Closure
- Post Mortem
- Out of Scope (Important!)
Communication
- You will receive a customer point of contact (CPOC).
- You will provide a point of contact to the customer.
Disclaimer
Acceptance
Verify Scope
Verifying Scope
Before starting any type of pentest you need to verify your scope.
Here’s a reference on what could happen: darknetdiaries.com/episode/22/
Find out who owns the subnet in the scope: bgp.he.net/
You have to make absolutely sure the network that you’re going to run a pentest on is the network it’s really supposed to be.
Communication
Client Communication
If the engagement is going well and there are not any critical findings, you may only reach out to the client a couple times. If there are no findings, everything is low importance, there may not be any reason to reach out to them that much.
If you run into something critical, break into the network, log into a web server, get any kind of RCE, you need to let them know immediately. If you can breach the external network, there is a chance that someone else has already done it. They will need to patch the vulnerability asap.
Kick off email example:
Good Morning Jacky Chan,
The external pentest is about to begin. Per our agreement, we will be testing the following IPs/ranges:
200.120.30.0/24
All pentesting activity will be performed from the following IP address:
192.168.1.1
If out testing triggers any alerting for you, please notify us at your earliest convenience so we can notate this in the report.
Finally, if you need anything at all during the testing, you can reach me at this email or by the phone number listed below.
Thank you,
Hacker Bob
Hacker Joes's Hacking
Hacker Joe, Pen Testing Engineer
555-555-1212 | email@domain.com
You can automate the process, set up emails to be sent and scans to start before you sit down to start work so you have some data to start looking at right away. Just make sure you keep the client happy so they don’t go to someone else for pentests. Communication is a high priority.