Think like a tester

Every legitimate test starts before any tool runs: a written scope that names the targets, the allowed techniques, and the stop conditions. No scope, no test. That single habit separates professionals from vandals, and it is what lets you practice freely inside labs like these.

The five phases

A test usually follows five phases. Recon: learn about the target without touching it — DNS records, certificate logs, public filings. Scanning: find what is reachable and what it runs, within the agreed limits. Assessment: decide what might be weak and why, ranking by impact before effort. Careful validation: prove one finding with the least invasive check available. Reporting: write what you found, how to reproduce it, and how to fix it, so the work survives review by someone who was not in the room.

Notice what is missing: there is no phase called running every exploit you have. Good testers spend most of their time on the first three phases, because a finding you understand beats ten you cannot explain. The rest of this track builds exactly that order: see first, touch second, prove third, write fourth.

Authorization is the technique

The commands in this track are identical to the ones attackers use — ct-fetch, crafted logins, crafted requests. Nothing about the keystrokes is ethical or unethical. The authorization boundary is the entire difference: a signed scope naming shop.test, a time window, a contact to call when something looks wrong, and a written stop condition (usually: stop at proof-of-concept, never persist, never exfiltrate).

Before you touch any target in this track, read its scope.txt. In real work the equivalent is the statement of work. Make it a reflex: scope first, technique second, notes always.

How findings are judged

Triagers and clients score findings on three axes. Impact: what does the attacker gain — data, access, disruption? Exploitability: how hard is it — unauthenticated remote, or admin-only with ten preconditions? Evidence: can a stranger reproduce it from your steps alone? A critical-severity claim with no reproduction is worth less than a medium with a perfect proof. You will practice all three in the reporting lesson that closes this track.

Key takeaways

• No written scope, no test — authorization is what makes technique legitimate.
• Recon → scanning → assessment → validation → reporting, in that order.
• Findings are judged on impact, exploitability, and reproducible evidence.