18. Ethics, the Law and a Safe Kali Lab
18.1 The One Rule: Permission and Scope
Quick answer: the short, self-contained version of this lesson is the guide Safe Metasploitable / Vulnerable Home Lab Setup.
Ethical hacker aani cyber criminal ekach tools, ekach techniques vapartat. Farak don goshtincha: likhit parvangi (written permission) aani tharavlela vyaap (scope). He nasel, tar tech kaam gunha aahe – "mi fakt shikat hoto" he uttar court madhe chalat nahi.
| Question | Ethical hacker | Criminal |
|---|---|---|
| Do you have written permission? | Yes, signed, before starting | No |
| Is the target inside an agreed scope? | Yes, exact IPs/domains listed | Attacks anything |
| What is the intent? | Find and help fix weaknesses | Wrongful gain or damage |
| What happens to findings? | Reported confidentially to the owner | Sold, leaked or abused |
| Are actions logged and reversible? | Yes, careful not to damage data | Often destructive |
Professionals work under a scope document (also called rules of engagement / अधिकृत परवानगी पत्र): it lists exactly which systems may be tested, which techniques are allowed, the time window, and who to call if something breaks. Bug bounty programs publish the same thing as a "program policy".
Only test what you own or have written permission for
Every lab in Parts 10 and 11 targets only your own machines: the Kali VM, Metasploitable 2, DVWA, OWASP Juice Shop, and your own reels app from Chapter 16. Scanning or attacking any other computer, website, Wi-Fi or phone without written permission is a crime in India, even "just to check" or "just to learn".
Ravindra Bagale's Tip
In their excitement, many students run Nmap against a friend's website or the neighbour's Wi-Fi – "just looking". That is a crime, and it can end your career before it even starts. Remember: permission first, tools later. You have your own lab for practice – do anything there, and nobody will say a word.
Ravindra Bagale's Tip – मराठी
बरेच students उत्साहात मित्राच्या website वर किंवा शेजारच्या Wi-Fi वर Nmap चालवतात – "फक्त बघत होतो" म्हणून. हा गुन्हा आहे आणि career सुरू होण्याआधीच संपू शकतं. लक्षात ठेवा: परवानगी आधी, tool नंतर. सरावासाठी तुमचा स्वतःचा lab आहे – तिथे काहीही करा, कोणी काही म्हणत नाही.
Ravindra Bagale's Tip – हिंदी
बहुत से students जोश में दोस्त की website या पड़ोसी के Wi-Fi पर Nmap चला देते हैं – "बस देख रहा था" कहकर. यह अपराध है और career शुरू होने से पहले ही ख़त्म हो सकता है. याद रखो: इजाज़त पहले, tool बाद में. Practice के लिए तुम्हारा अपना lab है – वहाँ कुछ भी करो, कोई कुछ नहीं कहेगा.
Practice task
Write a one-page scope document for your own lab: list the VM names and their host-only IP range as the only in-scope targets, the allowed techniques, and a line stating that nothing outside this range will ever be touched. Keep it with your notes.
Permission and scope in practice
The table above is the heart of ethical hacking. Let us make it concrete with numbers and documents you can copy.
Example 1: an Indian company (sample data)
Suppose we are a junior security tester at an Infosys client engagement. The signed scope letter says:
In scope: 10.20.30.0/28 (16 addresses), app.example.in, staging.example.in
Out of scope: production payments, employee email, any third-party SaaS
Window: 20–24 Oct 2026, 10:00–18:00 IST
Contact: security@example.in, +91-XXXXXXXXXXIf a scanner finds an open database on 10.20.30.50 (inside the range), you may test it. If the same company also has a server at 10.20.40.10, you must stop and ask. Scope is exact, not "everything that looks related".
Example 2: a global bug bounty
Google's Vulnerability Reward Program publishes which products are in scope, which are not, and which severity levels get paid. Testing a product that is listed as out of scope is still unauthorised, even if the company is famous for welcoming researchers.
Example 3: everyday life
A museum pass allows you into named galleries on named dates. It does not allow you into the storeroom. Scope works the same way.
What a good permission email looks like
Subject: Permission to test lab VMs on host-only network
I, <name>, authorise testing of the following systems that I own:
- Kali Linux VM, 192.168.56.10
- Metasploitable 2, 192.168.56.20
Network: VirtualBox host-only (192.168.56.0/24), no bridged adapter.
Purpose: learning defensive security.
Signed: <name>, <date>For your own home lab, you are both the tester and the owner, so a signed note to yourself still builds the right habit for professional work.
Common mistakes
- Assuming a friend's "sure, try hacking my site" WhatsApp message is enough. You need clear, written scope.
- Scanning a cloud IP that used to be yours. Cloud addresses get reassigned.
- Testing a mobile app's API servers without checking whether they are covered by the vendor's bounty rules.
Recap
- Written permission first. Exact scope second. Intent third.
- When in doubt, stop and ask.
Defender's worksheet (do this today)
- Write the lesson title and date in your notebook.
- List three systems you own (VMs, personal projects, or lab apps) where this lesson applies.
- Run one safe command or checklist item from the lesson on a lab system only.
- Paste the command and its output under an Evidence heading.
- Write one fix you would give a teammate in two sentences.
- Write one mistake students make with this topic and how to avoid it.
More real-world pictures
Indian workplace (sample data)
Suppose we are a junior analyst at Tech Mahindra supporting a client SOC. After reading this lesson you add one detection or one hardening item to the team weekly checklist, with the owner name and a due date. That is how learning becomes operations.
Global practice
Public bodies such as CERT-In (India), CISA (US) and NCSC (UK) publish advisories that map to the same ideas: patch, least privilege, logging and user awareness. Bookmark one advisory feed and read it every Monday.
Home and family
Explain this lesson to a family member in four sentences without jargon. If they can repeat the main warning back to you, you understand it well enough to teach.
Connect to earlier chapters
Parts 1 to 9 built Linux, web servers, databases and cloud pieces. This lesson only makes sense when you can point to a concrete config file, package name or architecture box from those parts. If you cannot, revisit the matching earlier chapter before you practise any tool command.
Common mistakes
- Skipping written permission just for a quick scan.
- Practising on hostel or office Wi-Fi targets without authorisation.
- Collecting tool output without writing the fix.
- Copying exploit commands onto production to verify. Verification for defenders means checking versions and patches, not firing modules.
Recap
- Evidence, fix, owner, date.
- Own lab only.
- Teach one other person the warning from this lesson.