{
  "slug": "target-scoping",
  "title": "Target Scoping & Rules of Engagement",
  "phase": "Scoping",
  "description": "Define the engagement scope, identify in-scope assets, review programme rules, and set up your testing environment before any active work begins.",
  "difficulty": "low",
  "tags": [
    "scoping",
    "rules-of-engagement",
    "setup",
    "bug-bounty",
    "methodology"
  ],
  "tools": [
    "Burp Suite",
    "browser",
    "note-taking tools"
  ],
  "steps": [
    {
      "id": "scope-01",
      "title": "Read the programme policy",
      "description": "Thoroughly read the bug bounty or pentest programme policy, noting scope boundaries, exclusions, disclosure rules, and any testing restrictions.",
      "commands": [
        "curl -s https://target.com/.well-known/security.txt",
        "curl -s https://target.com/security | grep -i 'scope\\|bounty\\|rules'"
      ],
      "notes": "Screenshot or save the policy page with a timestamp. Programmes update rules without notice, and you need proof of what was in scope when you tested."
    },
    {
      "id": "scope-02",
      "title": "Identify scope boundaries",
      "description": "List all in-scope domains, IP ranges, mobile applications, and API endpoints explicitly permitted by the programme.",
      "commands": [
        "echo 'target.com' > scope-domains.txt",
        "echo '*.target.com' >> scope-domains.txt",
        "echo '192.168.1.0/24' > scope-ips.txt"
      ],
      "notes": "If the programme says \"*.target.com\", confirm whether third-party hosted subdomains (e.g. support.target.com on Zendesk) are included. When in doubt, ask the programme owner."
    },
    {
      "id": "scope-03",
      "title": "Set up project structure and note-taking",
      "description": "Create a consistent directory structure and initialise your note-taking system so findings are organised from the start.",
      "commands": [
        "mkdir -p target-com/{recon,scans,vulns,screenshots,notes}",
        "echo '# Target: target.com' > target-com/notes/engagement-log.md",
        "echo 'Start date: $(date +%Y-%m-%d)' >> target-com/notes/engagement-log.md"
      ],
      "notes": "Use a repeatable folder layout across engagements. Tools like Obsidian, Notion, or even plain Markdown files work well as long as you are consistent."
    },
    {
      "id": "scope-04",
      "title": "Configure proxy and browser tooling",
      "description": "Set up Burp Suite or another intercepting proxy, install browser extensions, and verify traffic flows through your testing stack.",
      "commands": [
        "curl -x http://127.0.0.1:8080 -k https://target.com -o /dev/null -w '%{http_code}'"
      ],
      "notes": "Ensure your proxy CA certificate is installed in the browser and system trust store. Test with a simple request before starting active work to avoid missing traffic."
    },
    {
      "id": "scope-05",
      "title": "Verify safe harbour and legal protections",
      "description": "Confirm the programme offers safe harbour or authorisation language that protects you legally while testing within the defined scope.",
      "commands": [
        "curl -s https://target.com/.well-known/security.txt | grep -i 'policy\\|contact\\|hiring\\|acknowledgment'"
      ],
      "notes": "If the programme lacks explicit safe harbour language, consider requesting written authorisation before testing. Never test assets outside the stated scope regardless of what you discover."
    }
  ],
  "references": [
    "https://www.bugcrowd.com/resources/levelup/how-to-write-a-bug-bounty-report/",
    "https://owasp.org/www-project-web-security-testing-guide/",
    "https://portswigger.net/burp/documentation/desktop/getting-started",
    "https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability_Disclosure_Cheat_Sheet.html"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-06-17"
}