Scope, Wildcards, and Intake
A beautiful bug on an out-of-scope host is a waste of a week. Parse the policy like it is code.
Tags: scope, recon, intake
Level: beginner
Method
Parse wildcards
*.target.com does not mean target.com, and it does not mean foo.target.co.uk. Check third-party SaaS (Jira, Zendesk, GitHub pages).
Excluded classes
P5, missing SPF, rate-limit, best-practice CSP, self-XSS. Do not spend a day there unless you can chain.
Identity constraints
No testing other customers, no DoS, no brute above N, no malware. Plan the PoC inside those rails.
Asset inventory vs policy
Your recon will find hosts the policy forgot. Ask or skip. Do not 'assume wildcard'.
Field notes
- Vendor programs (MSRC, Google, Apple) are precise. Crowdsourced wildcards are sloppy. Read both like a lawyer.
- Save a dated copy of the policy with the report.