OSINT › Module 1 › Lesson 2
Rules of Engagement and Written Scope
If it is not written, it is not in scope — then draft YOUR self-OSINT RoE on
Visual · osint_roe_written_scope
RoE is written who / what / stop. Original Cyberlium.
Opening
Curiosity is not authorization. A sentence in a file is.
Lesson 1 named the verb: read published sources that are yours. This lesson names the contract. Rules of Engagement (RoE) answer who you may look at (you), what identifiers you may use (the ones you list), where notes live ($HOME/cyberlium-lab), and when you stop (router admin, classmate names, dumps, LAN scans). If those answers exist only in your head, you will “just check one more site” on someone else. Original Cyberlium. DEMO http://192.168.0.1/ is YOUR lab app.
1. Four RoE lines: who, what, where, stop
Who: the legal person sitting at this keyboard, plus handles/emails/domains that person owns. What: public pages, public DNS/WHOIS for YOUR domain, official tools pointed at YOUR identifiers. Where: notes under $HOME/cyberlium-lab, mode 600. Stop: consumer router banners, any third-party name, hydra, nmap /24, dump shops.
Written scope is how you refuse a classmate who says “run Sherlock on me for fun.” Fun is not a signature. If they are not in YOUR file as an owned alias, they are out. first; Router Admin is a stop, not a “network OSINT” bonus.
2. Authorization is not “the Wi-Fi password is mine”
Paying for home internet does not authorize people-search on everyone who ever used the SSID. Owning a laptop does not authorize Maigret on every GitHub user you envy. Scope is identifier-level: this handle is mine; that email is mine; that domain is in my registrar account.
Bellingcat’s public resources emphasize verification and sourcing. Steal that ethic (cite what you saw, keep notes) and leave their field work to people with a newsroom or a court. Your field is your own account pages.
Command guide
Authorization is not “the Wi-Fi password is mine”
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
pipx install sherlock-project sudo apt install python3
macOS:
Command — copy this
pipx install sherlock-project brew install python3
Windows:
Command — copy this
pip install sherlock-project
Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
printf '%s
' "wifi_password != authorization to collect guests" "home_router != OSINT lab if it is vendor admin" >> "$HOME/cyberlium-lab/t12-m01-l02-roe-scope.txt"
python3 - << 'PY'
import os
print("HANDLE env set?", bool(os.environ.get("HANDLE")))
print("write HANDLE only in YOUR scope file next lab — never a classmate")
PY3. Stop conditions you can say out loud
If a tool asks for a name that is not in your forthcoming scope.yaml, you stop. If curl of 192.168.0.1 is a router, you stop using that host. If a site wants payment for “fullz,” you stop and close it. Those sentences belong in the file now, before maps make tools look shiny.
Next lesson walks the maps as indexes. Maps without RoE are shopping lists for harm. RoE without maps is a locked empty room. You want both, in that order.
4. What you ship: four written RoE lines and named stop conditions
who/what/where/stop in t12-m01-l02-roe-scope.txt chmod 600. Stop includes router admin, third-party names, dumps, hydra, LAN nmap. DEMO identified or STOPPED. Teaching dest remains
5. What you record before the next lesson
Date. Four RoE lines. STOP_IF tags. DEMO GATE. SAFE NEVER classmate collection. File t12-m01-l02-roe-scope.txt chmod 600.
6. Wrong vs right: strangers vs identifiers YOU own
Worked failure — same OSINT word, opposite target. Right never needs a classmate or a dump site.
Wrong
Skip writing scope because “I would never stalk anyone.” Run Sherlock on a friend who laughed. Treat the home router as in-scope because you pay the bill.
Right
Write who/what/where/stop. / STOP if router. Keep notes 600. Next: Maps: OSINT Framework Bellingcat IntelTechniques.
Mission: write RoE before you open a map
1) / STOP if router. 2) Write who, what, where, stop in cyberlium-lab. 3) Add STOP_IF lines for classmates, dumps, and unowned domains. Do not point any people-search tool yet.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor why written stop conditions beat “I will be careful” — not how to add a classmate to scope “with consent in chat.”
Knowledge Check
APPLY: A classmate says “Sherlock me, I consent in Discord.” Your RoE file lists only YOUR handles. You:
Multiple choice
Knowledge Check
APPLY: True or False: Paying for home Wi-Fi authorizes people-search on every guest device.
True or False
Knowledge Check
APPLY: curl http://192.168.0.1/ is Netgear “Router Admin” while drafting RoE. Next?
Multiple choice