Chapter 24 — Authorized offensive security and red team: methods I
Lesson map
Lesson 24 published. Map, example, EX070.
flowchart TD
N0["Learning outcomes"]
N1["24.1 Sequence"]
N2["24.2 Method cards"]
N3["24.3 Done means artefacts"]
N4["24.2b Quiet vs noisy methods"]
N5["24.3b Method freeze"]
N6["24.1b Method dependencies"]
N7["24.4b Reviewing a method card"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX070"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["24.1 Sequence"]
N2["24.2 Method cards"]
N3["24.3 Done means artefacts"]
N4["24.2b Quiet vs noisy methods"]
N5["24.3b Method freeze"]
N6["24.1b Method dependencies"]
N7["24.4b Reviewing a method card"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX070"]
[Learning outcomes]
|
v
[24.1 Sequence]
|
v
[24.2 Method cards]
|
v
[24.3 Done means artefacts]
|
v
[24.2b Quiet vs noisy methods]
|
v
[24.3b Method freeze]
|
v
[24.1b Method dependencies]
|
v
[24.4b Reviewing a method card]
|
v
[Worked example] --> [Exercise EX070]
Learning outcomes
You will (1) sequence pre-engagement → discovery → validation → reporting per PTES/SP 800-115; (2) pick methods that match authorization; (3) define "done" for a method without a shell.
24.1 Sequence
Pre-engagement produces the signed ROE. Discovery enumerates in-scope assets by agreed methods. Validation confirms configuration issues with least privilege. Reporting delivers findings and evidence hashes. Skipping pre-engagement is how unauthorized testing happens.
Signed ROE before discovery is the whole safety story in one sentence. Validation with least privilege keeps the engagement inside granted roles. Reporting with hashes makes findings checkable. Sam's gate in TrackScope refuses discovery actions until a ROE hash is recorded, and a CI test attempts discovery with a missing hash and expects denial.
24.2 Method cards
Each method card: name, purpose, required privilege, noisy?, stop conditions, expected artefacts. "Authenticated configuration review" is a card; "weaponised exploit" is not in this programme's deck.
Privilege, noise and stop conditions on one card stop improvisation under pressure. Artefacts tell reviewers what done looks like. Weaponised exploits stay out of the catalogue by policy. Sam rejects a card that cannot name its stop condition in observable terms. Cards that survive review are numbered and frozen for the window; drafts stay in a separate catalogue branch.
24.3 Done means artefacts
A method is done when its artefacts exist: inventory CSV, config excerpts, finding drafts, coverage update — not when someone "feels finished".
"""Rebuild a synthetic engagement timeline from event records."""
events = [
("09:00", "ROE brief signed", "auth"),
("09:15", "scoped host inventory loaded (12 hosts)", "prep"),
("10:02", "service enumeration on 10.20.1.0/28", "enum"),
("10:45", "finding SYN-001 noted on staging UI", "find"),
("11:10", "stop: host 10.20.0.1 probed — out of scope", "stop"),
("11:12", "escalated to client contact; confirmed deny-list", "comm"),
("13:00", "resume on in-scope hosts only", "auth"),
("15:30", "debrief draft shared with client", "report"),
]
# print chronological with phase tags; compute stop latency
print("phase timeline:")
for t, msg, phase in events:
print(f" {t} [{phase:6}] {msg}")
t0 = 10*60+45; t1 = 11*60+10
print(f"minutes from SYN-001 note to stop: {t1-t0}")
print(f"stop reason present: yes")
print(f"events={len(events)} phases={len(set(p for _,_,p in events))}")
Expected output:
phase timeline:
09:00 [auth ] ROE brief signed
09:15 [prep ] scoped host inventory loaded (12 hosts)
10:02 [enum ] service enumeration on 10.20.1.0/28
10:45 [find ] finding SYN-001 noted on staging UI
11:10 [stop ] stop: host 10.20.0.1 probed — out of scope
11:12 [comm ] escalated to client contact; confirmed deny-list
13:00 [auth ] resume on in-scope hosts only
15:30 [report] debrief draft shared with client
minutes from SYN-001 note to stop: 25
stop reason present: yes
events=8 phases=7
Synthetic case — Riverstone Transit. The timeline lab shows a stop at 11:10 and resume after confirmation — the method card required that path.
Feelings do not survive handoff; files do. Inventory, excerpts, drafts and coverage updates are the checklist. Sam's method runner marks done only when each path exists and hashes are stored. Partial artefact sets leave the method in progress and block the next dependent method in the planner.
24.4 Errors and limits
Copying someone else's method list without matching authorization is cargo-cult PTES.
Borrowed method lists ignore local authorization and local fragility. Matching the card to the signed ROE is the real planning work. Sam starts from the ROE verbs and only then opens the catalogue. A card whose privilege line exceeds the ROE is removed before the schedule is published, and a noisy card that would consume more than 16% of a depot uplink — the budget from the physics worked example — is vetoed in the schedule UI with that percentage shown beside the method name.
24.2b Quiet vs noisy methods
Quiet methods (authenticated reads, config export) fit daytime windows on shared systems. Noisy methods (broad service enumeration) need tighter rate limits and often off-peak hours. The method card's "noisy?" field drives the schedule; leaving it blank is how morning dispatch windows get congested.
The noisy flag drives the calendar automatically when filled. Blank flags are how dispatch windows clog. Sam blocks schedule publish while any card still has a blank noise field. Cards are reviewed with the client contact before the window is published, because the client knows which shared systems are busy in the morning.
24.3b Method freeze
During an engagement window, adding a new method mid-flight needs the same authorization path as a scope widen. "While we were here we also tried…" is how ROE drift happens. Park ideas in the next engagement's planning backlog.
Mid-flight additions are scope drift with better branding. The widen path exists for a reason and applies to methods too. Parking ideas keeps the current window auditable. Sam logs freeze breaks as incidents even when the client later approves the method. Incident tickets for freeze breaks include the time, the method name and whether traffic already left the assessment zone.
24.1b Method dependencies
Some methods require outputs of others (inventory before authenticated review). Encode dependencies in the plan so the timeline does not schedule the review on day one against an empty asset list. PulseMap can show blocked-by links for planned techniques.
Review on day one against an empty inventory wastes the window and tempts shortcuts. Encoded dependencies make the planner refuse impossible orders. Sam renders the dependency graph in kickoff so the client sees the critical path. If a dependency slips, the planner moves the dependent method rather than letting it run early against partial data.
24.4b Reviewing a method card
Before a method card enters the catalogue, a second engineer reads it as if they had never seen the method: is the purpose clear, are stop conditions observable, does it name the evidence it produces? Sam's first card for passive service inventory came back with one change: the stop condition "if the network seems slow" became "if the client's monitoring reports latency above the agreed threshold."
A cold reader finds fuzzy stop conditions before production does. Observable thresholds replace vibes about slowness. Sam keeps the review comment next to the card version that fixed it.
Exercises
- EX070 — Card. Write a method card for authenticated web config review. Rubric: 3 = all fields filled safely; 2 = missing one; 1 = includes exploit; 0 = none.
- EX071 — Sequence error. What is wrong with discovery before signed ROE? Rubric: 3 = unauthorized testing; 2 = process vague; 1 = "bad order"; 0 = none.
- EX072 — Timeline. From the lab, what should appear in the report about 11:10–11:12? Rubric: 3 = out-of-scope probe, stop, escalate, confirm; 2 = stop only; 1 = omit; 0 = wrong.
Synthesis
Methods are authorized, carded and done when artefacts exist.
Continue studying — chapter 24 of 50
← Chapter 23 (draft) · Course chapter index · Chapter 25 (draft) →