Staying Legal & Safe

The one rule that protects your future

The skills you learn here are real. Using them on systems you do not own or have not been given permission to test is called unauthorised access, and in almost every country it is a crime — even if you did no damage and were "just curious".

The magic word is authorisation: clear permission, ideally in writing, that says exactly what you are allowed to test. The list of what you are allowed to touch is called the scope.

The good news: there are endless places to practise legally, which we cover next. Your reward flag for taking this seriously: ASEC{always_get_permission}

Safe playgrounds

You never have to break the law to get good. Practise in these places:

• This platform and other training labs built for learning.
• Your own machines and virtual machines (you own them, so you decide).
• Deliberately vulnerable apps you install yourself, such as DVWA or OWASP Juice Shop.
• Bug bounty programs, where companies invite you to find bugs within a defined scope and often pay you for them.

Master the basics in a safe lab first. The real targets will still be there when you are ready.

What "permission" actually means

You know the golden rule — only test what you are allowed to. But what does real permission look like? Two words define it: authorisation and scope.

• Authorisation is clear, ideally *written*, permission that says you may test a system. A verbal "sure, go ahead" is risky; professionals always get it in writing.
• Scope is the exact list of what you are allowed to touch — which domains, which IP addresses, which applications. Anything outside the scope is off-limits, even if it belongs to the same company. The exact list of systems you may test is called the scope.

Professionals also agree rules of engagement: when you can test, what techniques are banned (no denial-of-service, for example), and who to contact if something breaks. Stay strictly inside the scope, and you stay legal and trusted.

Flag: ASEC{stay_in_scope}

Same skills, different intentions

The difference between a criminal and a professional is not skill — it is intent and permission. Hackers are traditionally sorted by the colour of their "hat."

• White hat — the ethical hacker. Works *with* permission to improve security. This is what you are training to be.
• Black hat — the criminal. Breaks in illegally for personal gain, theft, or damage. A hacker who breaks in illegally for personal gain is a black hat.
• Grey hat — somewhere in between: may break rules or poke without permission, but usually without malicious intent. Still often illegal, and a risky place to be.

The exact same skills sit under every hat. What separates a respected professional from a criminal is choosing to always work with authorisation. Wear the white hat.

Flag: ASEC{know_your_hat}

You found a real bug by accident — now what?

Sometimes, just using the internet normally, you stumble onto a genuine security flaw in a real company's website. This is a defining ethical moment. What you do next matters enormously.

The right path is responsible disclosure:

1. Stop. Do not dig deeper, do not access data, do not "test how far it goes" — that turns a lucky find into a crime.
2. Report it privately to the company (look for a security.txt file, a security contact, or a bug bounty page).
3. Give them time to fix it before telling anyone else.

If you accidentally find a bug, you should report it, never exploit it. Never demand payment in a threatening way (that is extortion), and never post the flaw publicly before it is fixed. Doing this well is how researchers build great reputations.

Flag: ASEC{report_dont_exploit}

Get paid to hack, legally

The most exciting legal playground of all: bug bounty programs. Companies openly invite hackers to find vulnerabilities in their systems and pay a reward — a bounty — for each valid report.

How it works:

• Platforms like HackerOne and Bugcrowd list programs from real companies.
• Each program publishes its scope (what you may test) and rules — read them carefully, because the scope *is* your authorisation.
• You find a bug, write a clear report, and receive a bounty if it is valid — sometimes hundreds or thousands of dollars.

Bug bounties reward you with a bounty for a valid report. They are the bridge from practice labs to real-world impact — legal, ethical, and often lucrative. Start small, learn the rules, and grow.

Flag: ASEC{hack_for_reward}

With permission comes responsibility

Even when you are fully authorised, being *allowed* to test does not mean anything goes. A true professional works to cause the least possible harm.

Principles that mark a careful, trustworthy tester:

• Minimise impact. Do not crash systems, delete data, or degrade a live service. Prove a flaw exists without exploiting it fully.
• Protect any data you see. If you access personal or sensitive data during a test, do not copy, keep, or share it — note it and move on.
• Respect privacy. Never snoop through people's private information for curiosity.

Even when authorised, you should cause the least possible harm to the systems and people involved. This "first, do no harm" mindset is what earns lasting trust — and repeat work.

Flag: ASEC{first_do_no_harm}

The mindset that makes you a professional

You now have the ethical foundation that matters more than any technical skill. Let us set your compass.

Carry these with you into every room:

• Only ever test systems you own or are authorised to test — this is the one rule.
• Get permission in writing and stay strictly within scope.
• Wear the white hat — same skills, ethical intent.
• Report, do not exploit, if you find a real bug by accident.
• Do no harm and protect any data you encounter.
• Practise legally — labs, your own machines, and bug bounties.

Should you only ever test systems you own or are authorised to test? Yes — always, no exceptions. Keep this compass and your powerful new skills will open doors, not cell doors.

Your graduation flag for this room: ASEC{you_are_ethical}