187

Always have your slip with you! This is the golden rule of Red Teaming! If you don't have your Permission to Attack with you, it's like driving without a driver's license. That said, if you are caught during an engagement, I recommend the following: Present a forged Permission to Attack. This way, you can see if criminals could possibly trick a security ...


110

It depends on the scope of the engagement. If the customer wants you to focus on one specific task (e.g. bypassing locks, social engineering, etc.), then that's all you're authorized to do and all you are legally allowed to do. If the customer wants you to use "anything that's legal", in order to best simulate a real attacker, them you can indeed present a ...


50

There's a flip side: what to do if you discover a physical pentester. When I was working at a bank, I happened to notice the iconic metasploit cli welcome banner flash up for a second on a desktop in the middle of a cube farm. Physical pentesters are a part of life at a bank, and the rules of engagement are very clear beforehand. There are rules and ...


38

It depends very much on the situation and your contract. Usually, reputable companies who conduct physical pentests have extensive guidelines for their pentesters in many situations. Such instructions are to be followed. I'm going to give a rough overview over possible ways such third-parties may be interacted with: Local Police Local Police is to be ...


35

Unless your engagement is with the police, they are out of scope and you are not allowed to test them. If someone called the police, you already lost, actually. You should stop them right before they do that (friends of mine who do this kind of stuff work in England, where the emergency number is 999 and their principle is that they give up when someone ...


2

An obvious... no. You cannot break into private property and/or steal any form of belongings unless authorized to do so. Authorized, that is, by the owner(s) of the property. This includes non-invasive/non-damaging methods. Your local laws regarding the protection of property apply to the employees as much as to the stranger on the street. The company ...


1

Start by releasing him from those handcuffs. If the permission to attack slip did truly checkout, then John is not a criminal. He is simply a poor guy hired by your company trying to do his job, and has now found himself handcuffed to a chair. As such, I have my doubts he would try to run or attack anyone, so it should be safe to release him. As mentioned ...


Only top voted, non community-wiki answers of a minimum length are eligible