I am still in college. Recently, I completed my OSCP and have been asked by my professor to do a robust pentest on our University's Network Infrastructure. Although I agreed, I have no idea regarding what paperwork should I present the university authorities.(If any)

A contract might look like an overkill, I just need something that protects me in the worst case scenario. Since I am an amatuer, any advice is much appreciated.

  • 2
    You say you are an amateur? Didn't you say you completed your OSCP? That certificate says you are a professional now :)
    – Philipp
    Commented Jan 6, 2017 at 16:30
  • 3
    Not overkill - absolutely vital. You want them to indemnify you in the event that testing takes any of the devices in the network down, or if you cause service issues, or you come across data you're not supposed to be able to access, and for a whole host of other possible issues. You also want to make it clear that you can't promise that you found all issues - doesn't matter how good you are! I'd probably consider this too broad, to be honest...
    – Matthew
    Commented Jan 6, 2017 at 16:30
  • 2
    @Philipp Amateur in contracts/legal stuff and not pentest :)
    – xandfury
    Commented Jan 6, 2017 at 16:32
  • @Matthew Absolutely. Until now, I have communicated everything through mail, so that I have a record of everything. Please post any helpful links if you have any regarding this litigation stuff.
    – xandfury
    Commented Jan 6, 2017 at 16:35

3 Answers 3


'Contract might be overkill'

When they sue you for damages, that contract will keep you from counting bars.

Get a lawyer, sit down with your professor and sketch out the scope. Then get a SoW signed by all authorized signatories of your university. There's no one size fits all solution.

You also say that you've exchanged a SoW over email - not enough. Get it signed on hard paper or using a online provider. It is extremely important that the signatories be authorized. I'm sure your professor is a nice person, but he could simple use you to discover holes in the system, sell them to a third party and throw you under the bus.

If you can't afford a lawyer, at least ensure that you're familiar with the local laws and regulations. I recommend that you read the PTES's Rules of Engagement. Some important points:

  • Ensuring that you have permission to test

  • Evidence handling

  • What to do when you come across personal information

  • The scope of the test

If you haven't already, I definitely recommend going through it. It'll keep you safe while you're working. Spending a night in the slammer is no fun.

  • Actually, I have already discussed the SoW and exchanged it over email. Hiring a lawyer might be something, I would not be able to afford(I am still in school), I am considering it though. I request you to please add some details/links to your answer.
    – xandfury
    Commented Jan 6, 2017 at 17:00
  • 1
    @spunkpike - done. Edited my answer, please take a look
    – thel3l
    Commented Jan 6, 2017 at 17:06

TL:DR Get a contract, and make sure it is with the network owners. It should be with the university IT department. Please, please make sure this is the case.

A contract protects you, and also defines how far you're allowed to go. Writing one is a great way to make sure you're all on the same page for scope of the pentest. The university also should have a legal department who can help write this, though I'd advise you to read it very carefully for clauses about who pays for things.

However, I'd like to add some perspective from nearly a decade in academic IT. Your professor, on their own, is not authorized to let you do this. However, if they're a full professor, they enjoy considerable protection from most universities. You, however, do not.

Academia is messy, professors do wierd, crazy things. They bring in devices from home, and plug them into the network. They run servers under their desks. They regularly lose important data, run their own websites exposing student information to the wider internet, share passwords, misuse systems, etc, etc.

It is entirely possible your professor dreamed this up without consulting the actual network owners

If this is the case, you're in big legal trouble, as you and your professor have carried out an unauthorized attack on a network. Please make sure that you have a contact in central university IT, make sure they're appraised of the scope of the exercise, and make sure they're in full agreement about what you're planning to do. Keep them copied in on all the emails.

The scenario I'm describing wouldn't be the wildest thing I've seen happen, and, when things go wrong, it wouldn't be the wildest thing that a professor swears they only authorized you to go so far, or denies all knowledge. I'd also add that a sizable percentage of people with tenure get there by being a brutal political operator, and have a whole bunch of practice in distancing themselves from failed projects.

  • I'm sorry, not sure why this came up so high in my feed, didn't see that it's 3 years old
    – lupe
    Commented Sep 20, 2022 at 8:58

Well, to start off, you have already finished your OSCP. However, I'm going to assume the reason why your professor asked you to pentest the University's Network is as a "final project" in which you make use of what you know. Saying that your interest is to test what you've learnt is a good idea.

Now, answering your question, Yes, you should present paperwork, but usually written evidence from the organization's authorities will do in most cases. An E-Mail from your professor, another one from the University's Authorities, and, if possible, another one from the IT department would usually be enough.

However, since Penetration Testing can be carried with bad intentions, I would advice you to talk to your teacher and ask him to not only e-mail you, but also to e-mail the University's Institution and the IT asking for permission.

I would say that written evidence is a must when talking about carrying Penetration Testing. I still recommend you the contract option, it may seem overkill, but it is, as I have said, the safest option. If I were you, I would get both a contract, and other evidence like e-mails, etc.

Hope it was helpful.

  • 2
    "a contract is not always necessary, but it will keep you safe and you should always use one" Give me one instance where it wouldn't CYA
    – thel3l
    Commented Jan 6, 2017 at 16:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .