# ⚠️ Disclaimer & Legal Notice

> 🛑 **Read this before running anything.**
> Understanding the legal and ethical boundaries of these tools is not optional — it is the foundation of professional security work.

---

## 🎯 Purpose of This Material

The techniques, tools, and commands documented in this module — including network reconnaissance, vulnerability exploitation, credential attacks, privilege escalation, and persistence mechanisms — are provided **strictly for educational purposes**.

All labs target **Metasploitable**, a deliberately vulnerable VM created by Rapid7 for security training. It has **no internet connectivity** and runs in an isolated, private host-only network.

---

## ✅ What Is Lawful

The following uses are **legal and professionally accepted**:

| ✅ Scenario | 📝 Notes |
|-----------|---------|
| 🖥️ **Your own lab environment** | VMs on your hardware (VirtualBox, VMware) with no external connectivity |
| 📄 **Authorized penetration tests** | Signed contract + written permission from the system owner |
| 🏴 **CTF competitions** | Hack The Box, TryHackMe, PicoCTF, CTFtime.org — participation implies authorization |
| 💰 **Bug bounty programs** | Testing strictly within published scope on HackerOne, Bugcrowd, etc. |
| 🏢 **Internal security assessments** | Employees or contractors with explicit written authorization |
| 🔬 **Research on your own systems** | Studying vulnerabilities and exploit mechanics on hardware/software you own |
| 🛡️ **Defensive auditing** | Running tools to audit your own network and validate your own security controls |

---

## 🚫 What Is Unlawful

The following are **illegal** under most national and international laws — including the U.S. **Computer Fraud and Abuse Act (CFAA)**, the **EU Directive 2013/40/EU**, and Italy's **Art. 615-ter C.P.** (unauthorized access to computer systems):

> 🔴 **No authorization = criminal offense.** Intent does not matter — unauthorized access is illegal even if no data is touched.

- 🔍 **Scanning or probing systems you don't own** — even a single Nmap scan without permission
- 💥 **Exploiting vulnerabilities on unauthorized systems** — regardless of intent
- 🔑 **Brute-forcing authentication** on live services (SSH, SMB, web logins) without written permission
- 🎧 **Intercepting network traffic** on networks you don't administer
- 🪝 **Installing backdoors, cron jobs, reverse shells, or persistence** on unauthorized systems
- 📤 **Exfiltrating data** — even as a "proof of concept" — without explicit contractual authorization
- 🐍 **Running exploit scripts** (e.g., `49757.py` for CVE-2011-2523) against production or unowned systems
- 🔓 **Cracking password hashes** obtained from unauthorized systems
- 💣 **DoS/DDoS attacks** of any kind, against any target
- 🦠 **Running Metasploit modules, Nmap vuln scripts, or Medusa** against internet-facing or third-party systems
- 🔀 **Pivoting or lateral movement** beyond the agreed scope in an engagement

> 💡 *"I didn't know who owned it"* is not a legal defense. Scanning a public IP is an **active intrusion attempt** if unauthorized.

---

## 🛠️ Tool-Specific Notes

### 🗺️ Nmap
A legitimate and widely used network discovery tool — but aggressive modes (`-A`, `-sV`, `--script vuln`) generate significant traffic and **will trigger IDS/IPS alerts**. Use only against authorized targets.

### 🔐 Medusa / Hydra
Brute-force tools **lock out accounts** and generate prominent log entries. Their use against any live system without written authorization is a criminal offense in most jurisdictions.

### 🟥 Metasploit Framework
Used by professional pentesters worldwide. But running exploit modules (`distcc`, `vsftpd`, `multi/handler`, etc.) against unauthorized systems is illegal — full stop.

### 💀 John the Ripper / Hashcat
Password cracking is only lawful when you obtained the hashes from a system you are authorized to test. Possessing and cracking hashes from breached databases may also be illegal depending on jurisdiction.

### 🐱 NetCat
A general-purpose networking Swiss Army knife. Using it as a **bind shell or reverse shell listener** on unauthorized systems constitutes backdoor installation — this is a serious criminal offense.

### 🐍 Python Exploit Scripts (`49757.py`)
Exploit code targeting CVE-2011-2523 (vsftpd 2.3.4 backdoor) is included for **lab study only**. Never run against production systems.

### ⚙️ GTFOBins Techniques
SUID exploitation and sudo abuse are **post-exploitation techniques** — they assume you already have authorized access. Using them to escalate privileges on an unauthorized system compounds the severity of the crime.

---

## 📢 Responsible Disclosure

If you discover a vulnerability during legitimate research or an authorized test in software used by third parties:

```
1. 🛑  Do NOT exploit it beyond what's needed to confirm the finding.
2. 📬  Report it PRIVATELY to the vendor — give them time to patch (typically 90 days).
3. 🤐  Do NOT publish technical details until a fix is available.
4. 📋  Document your process — responsible disclosure protects you legally.
```

> 🏆 The 90-day standard comes from **Google Project Zero** and is widely adopted across the security industry.

---

## 🧭 Ethical Responsibilities

Beyond legal compliance, professional security practitioners are expected to:

- 🔒 **Protect client data** — credentials, PII, and business information must not be retained or used beyond the engagement
- 🩺 **Minimize impact** — avoid disrupting production services or causing collateral damage, even when authorized
- 🧹 **Remove all artifacts** — backdoors, test accounts, cron jobs, and persistence mechanisms must be cleaned up before the engagement closes
- 📋 **Report all findings** — withholding vulnerabilities from a client is a violation of professional ethics, regardless of how they reflect on scope or planning

---

## 📊 At a Glance

| 🔧 Action | 🟢 Authorized Lab | 🟡 Authorized Pentest | 🔴 No Authorization |
|----------|-----------------|----------------------|---------------------|
| Port scanning | ✅ Legal | ✅ Legal | ❌ **Illegal** |
| Vulnerability scanning | ✅ Legal | ✅ Legal | ❌ **Illegal** |
| Exploitation | ✅ Legal | ✅ In scope only | ❌ **Illegal** |
| Brute-force | ✅ Legal | ✅ In scope only | ❌ **Illegal** |
| Privilege escalation | ✅ Legal | ✅ In scope only | ❌ **Illegal** |
| Persistence installation | ✅ Legal | ✅ Must be removed | ❌ **Illegal** |
| Data exfiltration (PoC) | ✅ Legal | ✅ Must be documented | ❌ **Illegal** |

---

> ## 🔑 The Golden Rule
>
> **The tools do not determine legality. Authorization does.**
>
> Every technique in this module exists to make you a better defender.
> Use them wisely. Use them responsibly. Use them only where you're allowed to. 🛡️
