2

I am still in college. Recently, I completed my OSCP and have been asked by my professor to do a robust pentest on our University's Network Infrastructure. Although I agreed, I have no idea regarding what paperwork should I present the university authorities.(If any)

A contract might look like an overkill, I just need something that protects me in the worst case scenario. Since I am an amatuer, any advice is much appreciated.

  • 2
    You say you are an amateur? Didn't you say you completed your OSCP? That certificate says you are a professional now :) – Philipp Jan 6 '17 at 16:30
  • 1
    Not overkill - absolutely vital. You want them to indemnify you in the event that testing takes any of the devices in the network down, or if you cause service issues, or you come across data you're not supposed to be able to access, and for a whole host of other possible issues. You also want to make it clear that you can't promise that you found all issues - doesn't matter how good you are! I'd probably consider this too broad, to be honest... – Matthew Jan 6 '17 at 16:30
  • 1
    @Philipp Amateur in contracts/legal stuff and not pentest :) – xandfury Jan 6 '17 at 16:32
  • @Matthew Absolutely. Until now, I have communicated everything through mail, so that I have a record of everything. Please post any helpful links if you have any regarding this litigation stuff. – xandfury Jan 6 '17 at 16:35
14

'Contract might be overkill'

When they sue you for damages, that contract will keep you from counting bars.

Get a lawyer, sit down with your professor and sketch out the scope. Then get a SoW signed by all authorized signatories of your university. There's no one size fits all solution.

You also say that you've exchanged a SoW over email - not enough. Get it signed on hard paper or using a online provider. It is extremely important that the signatories be authorized. I'm sure your professor is a nice person, but he could simple use you to discover holes in the system, sell them to a third party and throw you under the bus.

If you can't afford a lawyer, at least ensure that you're familiar with the local laws and regulations. I recommend that you read the PTES's Rules of Engagement. Some important points:

  • Ensuring that you have permission to test

  • Evidence handling

  • What to do when you come across personal information

  • The scope of the test

If you haven't already, I definitely recommend going through it. It'll keep you safe while you're working. Spending a night in the slammer is no fun.

  • Actually, I have already discussed the SoW and exchanged it over email. Hiring a lawyer might be something, I would not be able to afford(I am still in school), I am considering it though. I request you to please add some details/links to your answer. – xandfury Jan 6 '17 at 17:00
  • 1
    @spunkpike - done. Edited my answer, please take a look – thel3l Jan 6 '17 at 17:06
-1

Well, to start off, you have already finished your OSCP. However, I'm going to assume the reason why your professor asked you to pentest the University's Network is as a "final project" in which you make use of what you know. Saying that your interest is to test what you've learnt is a good idea.

Now, answering your question, Yes, you should present paperwork, but usually written evidence from the organization's authorities will do in most cases. An E-Mail from your professor, another one from the University's Authorities, and, if possible, another one from the IT department would usually be enough.

However, since Penetration Testing can be carried with bad intentions, I would advice you to talk to your teacher and ask him to not only e-mail you, but also to e-mail the University's Institution and the IT asking for permission.

I would say that written evidence is a must when talking about carrying Penetration Testing. I still recommend you the contract option, it may seem overkill, but it is, as I have said, the safest option. If I were you, I would get both a contract, and other evidence like e-mails, etc.

Hope it was helpful.

  • 2
    "a contract is not always necessary, but it will keep you safe and you should always use one" Give me one instance where it wouldn't CYA – thel3l Jan 6 '17 at 16:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.