18. Ethics, the Law and a Safe Kali Lab
18.6 The Pre-Engagement Checklist
Quick answer: the short, self-contained version of this lesson is the guide What Is Penetration Testing? (Ethical, Authorised Only).
Pratyek lab session aadhi ha checklist manatun ghya. Ha tumhala kaydyachya aani technical donhi chuka pasun vachavto.
| Before you touch any tool | Done? |
|---|---|
Target is my own VM / app, inside my host-only range (e.g. 192.168.56.0/24) |
☐ |
| Vulnerable VMs have no bridged/NAT adapter (host-only only) | ☐ |
| I have a written scope note listing the exact in-scope targets | ☐ |
| Clean snapshots taken so I can roll back | ☐ |
Terminal logging on (script) or notes open |
☐ |
| I will record every command and its result | ☐ |
| I will pair every attack I try with the defence that stops it | ☐ |
| Nothing outside the lab range will be touched, ever | ☐ |
This checklist is the habit that separates a professional from someone who gets into trouble. In a paid job you replace "my own VM" with "the signed scope document", but the discipline is identical.
Why this matters for security
A checklist turns good intentions into a repeatable process. Real engagements begin with exactly this kind of pre-flight: confirm scope, confirm you can restore, confirm you are logging. It protects the client's systems and protects you legally.
Ravindra Bagale's Tip
Forgetting to take a snapshot is a common student mistake – an exploit breaks Metasploitable and you have to start again from scratch. With a clean snapshot, you're back in one click! And if you keep a session log, all your commands are ready when you write the report. Build these two habits.
Ravindra Bagale's Tip – मराठी
Snapshot घ्यायला विसरणं ही students ची common चूक – exploit ने Metasploitable खराब होतं आणि पुन्हा सुरुवातीपासून सुरू करावं लागतं. Clean snapshot असेल तर एका click मध्ये परत! आणि session log ठेवला तर report लिहिताना सगळे commands तयार असतात. या दोन सवयी लावून घ्या.
Ravindra Bagale's Tip – हिंदी
Snapshot लेना भूल जाना students की common गलती है – exploit से Metasploitable ख़राब हो जाता है और फिर शुरू से शुरू करना पड़ता है. Clean snapshot हो तो एक click में वापस! और session log रखो तो report लिखते समय सारे commands तैयार रहते हैं. ये दो आदतें बना लो.
Lab
Fill in the checklist above for your lab, take a fresh snapshot of Kali and Metasploitable 2, start script logging, and confirm from Kali that you can reach 192.168.56.20 but not the internet.
Why every box on the checklist matters
Each empty checkbox is a way to hurt yourself or someone else by mistake. Let us walk through them.
Checklist item → why
Each empty checkbox is a way things go wrong.
Host-only range only
If the vulnerable VM has a bridged adapter, your tools may reach the real LAN. That can scan a classmate's laptop or your home router without permission.
VBoxManage showvminfo msf2 | grep NICWhat you see:
Attachment: Host-onlyWritten scope note
Without it, you forget what you promised yourself. In professional work, the same note protects both sides.
Clean snapshots
When a tool bricks a lab VM, a snapshot brings you back in one click. Without it, you rebuild for an hour.
Logging commands
script or a notes file turns a messy evening into a report you can study later.
script session.txtWhat you see:
Script started, file is session.txtAttack ↔ defence pair
Every technique you try should end with "how do I stop this?" That is what makes you a defender.
Real examples
Indian company (sample): a TCS project's pre-engagement checklist is a gated ticket. No ticket, no scan. Global: CREST and similar professional standards expect clear scoping before testing. Everyday: a surgeon's checklist before an operation. Skipping "confirm the patient" is unthinkable.
Recap
- The checklist is not bureaucracy. It is how you stay legal and learn faster.
- Fill it every session, even for a 20-minute lab.
Defender's worksheet (do this today)
- Write the lesson title and date in your notebook.
- List three systems you own (VMs, personal projects, or lab apps) where this lesson applies.
- Run one safe command or checklist item from the lesson on a lab system only.
- Paste the command and its output under an Evidence heading.
- Write one fix you would give a teammate in two sentences.
- Write one mistake students make with this topic and how to avoid it.
More real-world pictures
Indian workplace (sample data)
Suppose we are a junior analyst at Tech Mahindra supporting a client SOC. After reading this lesson you add one detection or one hardening item to the team weekly checklist, with the owner name and a due date. That is how learning becomes operations.
Global practice
Public bodies such as CERT-In (India), CISA (US) and NCSC (UK) publish advisories that map to the same ideas: patch, least privilege, logging and user awareness. Bookmark one advisory feed and read it every Monday.
Home and family
Explain this lesson to a family member in four sentences without jargon. If they can repeat the main warning back to you, you understand it well enough to teach.
Connect to earlier chapters
Parts 1 to 9 built Linux, web servers, databases and cloud pieces. This lesson only makes sense when you can point to a concrete config file, package name or architecture box from those parts. If you cannot, revisit the matching earlier chapter before you practise any tool command.
Common mistakes
- Skipping written permission just for a quick scan.
- Practising on hostel or office Wi-Fi targets without authorisation.
- Collecting tool output without writing the fix.
- Copying exploit commands onto production to verify. Verification for defenders means checking versions and patches, not firing modules.
Recap
- Evidence, fix, owner, date.
- Own lab only.
- Teach one other person the warning from this lesson.