Agent WranglersRules of engagement Required
Do no harm
Prove a hole with the smallest harmless proof, then stop. Never delete data, flood the server, or read more records than needed.
How to do it
Use proofs that change nothing, such as a marker string that shows up in a page. Read one record to prove access, not the whole table. Stay at or below the request rate in the scope file. Stop at once when the median response time doubles or more than 1% of replies are 5xx errors. Then call the contact.
Example
Good proof: the page shows the marker PENTEST-7f3c where only text should be
Bad proof: a script that reads every customer to prove the holeHow to check
The test log shows no deletes, no reads of more than one record per proof and no burst above the agreed rate.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/do-no-harm.