Out of Scope
Out-of-scope lists protect strangers and production — name what you will NEVER touch beyond $LAB_HOST.
Visual · pentest_out_of_scope
Out-of-scope literacy. $LAB_HOST only. Original Cyberlium.
Professional pentesters spend kickoff time on what they will NOT do. So will you.
Out-of-scope items include: production databases, third-party SaaS, physical security, social engineering against staff (unless explicitly in scope), denial-of-service, and any host not listed — dorm LANs, café Wi-Fi, classmate machines, internet ranges. Stopping when you hit out-of-scope is a core skill, not a failure. Cyberlium treats out-of-scope as hard stops — not suggestions. You will NOT 'just peek' at a neighbor's SMB share because enumeration is fun. Next: Scope Lab.
1. Common out-of-scope categories
Third-party infrastructure (payment gateways, CDN edges you do not own), employee personal devices, unrelated business units, and destructive attacks (ransomware simulation, wipe tests) unless contract explicitly allows.
Your lab out-of-scope list: anything that is not $LAB_HOST — full stop. No dorm, no café, no classmate VMs.
Command guide
Try these commands — Common out-of-scope categories
═══ LINUX / KALI (Penetration Testing & Service Audit) ═══
Port scan and service banner grabbing against authorized target
Command — copy this
nmap -sV -sC -Pn -T4 -p 21,22,80,443,445,3389 ${LAB_HOST:-127.0.0.1}Enumerate web directories and hidden endpoints
Command — copy this
gobuster dir -u http://${LAB_HOST:-127.0.0.1} -w /usr/share/wordlists/dirb/common.txt -q -t 20 2>/dev/null || head -5 /etc/hostsMetasploit framework module inspection (Safe lab syntax)
Command — copy this
msfconsole -q -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 127.0.0.1; set PORTS 80,443; run; exit" 2>/dev/null || echo "Run in Kali msfconsole"
═══ WINDOWS (Audit Target) ═══ Enumerate open listening ports with process mappings
Command — copy this
netstat -ano | findstr /i "LISTENING"
Primary tools to practice this lesson: curl, searchsploit. Reference sites: Exploit-DB literacy (https://www.exploit-db.com/); SearchSploit (https://www.exploit-db.com/searchsploit). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Stop means stop — document and escalate
If recon reveals an adjacent host outside scope, note it and stop — do not pivot. Enterprise testers report potential scope creep to engagement leads. In Cyberlium, you redact stranger IPs from notes and return to $LAB_HOST.
Curiosity without stop discipline is how students become unauthorized access cases.
3. Out-of-scope protects you and strangers
Written exclusions defend testers in legal review and protect neighbors from collateral scanning. chmod 600 notes that say NEVER dorm/café/classmate/production-without-contract.
Ship: out-of-scope bullet list for YOUR lab engagement. Next: Scope Lab.
4. What you ship: out-of-scope NEVER list
List categories and hard stops. $LAB_HOST only in-scope. NEVER stranger LANs, café, classmates, production without contract. chmod 600.
5. What you record before the next lesson
Date. Out-of-scope bullets. $LAB_HOST in-scope reaffirmed. File t19-m02-l03-out-of-scope.txt chmod 600.
6. Wrong vs right: stranger nets vs YOUR lab VMs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Pivot to roommate PC 'because it responded.' Add Shodan results to scope mid-engagement.
- Right: Write out-of-scope NEVER list. Stop at boundary. Next: Scope Lab.
Mission: freeze out-of-scope stops
1) Write five out-of-scope categories for YOUR lab. 2) Include dorm LANs, café Wi-Fi, classmate hosts, production without contract. 3) chmod 600. Stop when target is not $LAB_HOST.
Stuck? Ask Cyberlium AI Mentor
Out-of-scope is permission to say no — use it before tools touch strangers.
APPLY: You discover a host outside written scope during recon on $LAB_HOST. You:
APPLY: True or False: Out-of-scope lists are optional suggestions in professional pentest.
APPLY: Cyberlium lab out-of-scope includes: