Penetration › Module 2 › Lesson 2
Scoping
Scope documents name targets, methods, and limits — draft YOUR pentest scope for $LAB_HOST.
Visual · pentest_scoping
Scoping literacy. $LAB_HOST only. Original Cyberlium.
Opening
Scope is the contract boundary. If the host is not listed, the tool stays holstered.
Pentest scope names in-scope assets ($LAB_HOST and lab services), allowed techniques (recon, enumeration, lab exploit validation per brief), time windows, data handling rules, and escalation contacts. Scoping meetings align testers and owners before packets fly. Vague scope creates legal risk and neighbor harm. Cyberlium teaches scope literacy on YOUR lab — not scope laundering to justify café Wi-Fi or classmate targets. Next: Out of Scope.
1. Scope elements pentesters expect
Targets: IPs, hostnames, apps on $LAB_HOST. Methods: passive/active recon limits, exploit validation allowed or forbidden on production adjacent systems. Window: lab hours you set. Evidence: where notes live ($HOME/cyberlium-lab, chmod 600).
Professional scopes also name third parties (cloud providers, MSSPs) and get their approval when needed. Your lab scope is simpler — one VM you own.
Command guide
Try these commands — Scope elements pentesters expect
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Grey box testing — credentials you own on lab VM Nmap discovery — https://nmap.org/book/man-host-discovery.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap
macOS:
Command — copy this
brew install nmap
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
grep box_type "$HOME/cyberlium-lab/t19-scope.txt" 2>/dev/null || echo 'box_type: grey (example)' >> "$HOME/cyberlium-lab/t19-scope.txt" source "$HOME/cyberlium-lab/t19-lab.env"; nmap -Pn -sn "$LAB_HOST"
Primary tools to practice this lesson: grep, nmap. Reference sites: Grey box testing; Nmap discovery (https://nmap.org/book/man-host-discovery.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Tight scope beats heroics
OSCP-style learning benefits from narrow scope: one $LAB_HOST, known services, revertible snapshot. Expanding to 'anything on my LAN' invites roommate incidents and RoE violations.
Document scope before opening nmap — same habit enterprise testers use in kickoff meetings.
3. Scope on paper, not in chat
Discord 'just try this IP' is not scope. Written files survive audits; chat paste does not. If a classmate wants testing, they write their own RoE on their own $LAB_HOST.
Next lesson names what scope explicitly excludes — often more important than in-scope lists.
4. What you ship: scope outline for $LAB_HOST
Targets, methods, window, evidence path. $LAB_HOST named. chmod 600. No stranger expansion.
5. What you record before the next lesson
Date. Scope elements listed. $LAB_HOST named. File t19-m02-l02-scoping.txt chmod 600.
6. Wrong vs right: stranger nets vs YOUR lab VMs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Scope = 'everything pingable.' Add classmate IP because they asked in chat.
Right
Write scope elements for $LAB_HOST only. Next: Out of Scope.
Mission: draft pentest scope for YOUR lab
1) List targets ($LAB_HOST), methods, window, evidence path. 2) Confirm scope is written — not chat-only. 3) chmod 600. Never add stranger hosts without contract.
Stuck? Ask Cyberlium AI Mentor
Scope meetings feel slow — slow beats explaining unauthorized shells to strangers.
Knowledge Check
APPLY: Pentest scope should name:
Multiple choice
Knowledge Check
APPLY: True or False: Discord paste can replace written scope for pentest.
True or False
Knowledge Check
APPLY: Best scope for Cyberlium lab learning:
Multiple choice