I am still in college. Recently, I completed my OSCP and have been asked by my professor to do a robust pentest on our University's Network Infrastructure. Although I agreed, I have no idea regarding what paperwork should I present the university authorities.(If any)
A contract might look like an overkill, I just need something that protects me in the worst case scenario. Since I am an amatuer, any advice is much appreciated.
'Contract might be overkill'
When they sue you for damages, that contract will keep you from counting bars.
Get a lawyer, sit down with your professor and sketch out the scope. Then get a SoW signed by all authorized signatories of your university. There's no one size fits all solution.
You also say that you've exchanged a SoW over email - not enough. Get it signed on hard paper or using a online provider. It is extremely important that the signatories be authorized. I'm sure your professor is a nice person, but he could simple use you to discover holes in the system, sell them to a third party and throw you under the bus.
If you can't afford a lawyer, at least ensure that you're familiar with the local laws and regulations. I recommend that you read the PTES's Rules of Engagement. Some important points:
Ensuring that you have permission to test
Evidence handling
What to do when you come across personal information
The scope of the test
If you haven't already, I definitely recommend going through it. It'll keep you safe while you're working. Spending a night in the slammer is no fun.
TL:DR Get a contract, and make sure it is with the network owners. It should be with the university IT department. Please, please make sure this is the case.
A contract protects you, and also defines how far you're allowed to go. Writing one is a great way to make sure you're all on the same page for scope of the pentest. The university also should have a legal department who can help write this, though I'd advise you to read it very carefully for clauses about who pays for things.
However, I'd like to add some perspective from nearly a decade in academic IT. Your professor, on their own, is not authorized to let you do this. However, if they're a full professor, they enjoy considerable protection from most universities. You, however, do not.
Academia is messy, professors do wierd, crazy things. They bring in devices from home, and plug them into the network. They run servers under their desks. They regularly lose important data, run their own websites exposing student information to the wider internet, share passwords, misuse systems, etc, etc.
It is entirely possible your professor dreamed this up without consulting the actual network owners
If this is the case, you're in big legal trouble, as you and your professor have carried out an unauthorized attack on a network. Please make sure that you have a contact in central university IT, make sure they're appraised of the scope of the exercise, and make sure they're in full agreement about what you're planning to do. Keep them copied in on all the emails.
The scenario I'm describing wouldn't be the wildest thing I've seen happen, and, when things go wrong, it wouldn't be the wildest thing that a professor swears they only authorized you to go so far, or denies all knowledge. I'd also add that a sizable percentage of people with tenure get there by being a brutal political operator, and have a whole bunch of practice in distancing themselves from failed projects.
Well, to start off, you have already finished your OSCP. However, I'm going to assume the reason why your professor asked you to pentest the University's Network is as a "final project" in which you make use of what you know. Saying that your interest is to test what you've learnt is a good idea.
Now, answering your question, Yes, you should present paperwork, but usually written evidence from the organization's authorities will do in most cases. An E-Mail from your professor, another one from the University's Authorities, and, if possible, another one from the IT department would usually be enough.
However, since Penetration Testing can be carried with bad intentions, I would advice you to talk to your teacher and ask him to not only e-mail you, but also to e-mail the University's Institution and the IT asking for permission.
I would say that written evidence is a must when talking about carrying Penetration Testing. I still recommend you the contract option, it may seem overkill, but it is, as I have said, the safest option. If I were you, I would get both a contract, and other evidence like e-mails, etc.
Hope it was helpful.
