# How to Practise Penetration Testing Legally: Labs, Ranges and Rules of Engagement

> Where and how to practise penetration testing without breaking the law: hosted labs, home labs (GOAD, Juice Shop, DVWA), cloud provider testing rules for AWS, Azure and Google Cloud as of October 2026, rules of engagement, safe phishing and lateral-movement simulation, and what the law says.

Source: https://playciso.com/blog/how-to-practise-penetration-testing-legally · Published: 2026-10-29 · Publisher: PlayCISO (https://playciso.com)

---

The line between a penetration tester and an attacker is permission. The skills are the same; what makes one a career and the other a crime is a written authorisation that says exactly what you may test, when and how. This guide covers where to practise legally, how cloud providers’ rules work as of October 2026, what a rules of engagement document needs, and how to simulate phishing and lateral movement without hurting anyone. _This is general information, not legal advice. Laws differ by country; if you are unsure whether something is authorised, assume it is not and ask a lawyer._ ## What makes penetration testing legal? Authorisation from someone who has the right to give it. In the United States the Computer Fraud and Abuse Act (18 U.S.C. 1030) criminalises accessing a computer without authorisation or exceeding authorised access; in the UK the Computer Misuse Act 1990 does the same; most countries have an equivalent. In May 2022 the US Department of Justice told prosecutors not to charge good-faith security research under the CFAA, but that policy does not bind state prosecutors or civil claims, and “I was only testing” is not a defence on its own. Practical rule: if you do not have it in writing, you do not have it. Bug bounty programmes are a form of written permission, but only for what their policy says is in scope, using the methods it allows. Anything outside the published scope is unauthorised. ## Where can you practise penetration testing legally? OptionBest forWhy it is safeMain drawbackCost (Oct 2026) Hosted practice platforms (Hack The Box, TryHackMe, OffSec Proving Grounds)Realistic machines without building anythingThe targets exist to be attacked and the terms permit itYou must stay within the platform’s targetsFree tiers; paid plans from about $14 to $25 per month [PortSwigger Web Security Academy](https://portswigger.net/web-security)Web application testingPurpose-built labsWeb onlyFree Home lab: [GOAD](https://github.com/Orange-Cyberdefense/GOAD)Active Directory attacksRuns on your own hardware, isolatedAbout 115 GB of disk; Windows evaluation licences expire after 180 daysFree Home lab: [OWASP Juice Shop](https://owasp.org/www-project-juice-shop/), DVWAWeb vulnerabilitiesRuns locallyKeep it off the internetFree Your own cloud account (CloudGoat, Stratus Red Team)Cloud attack pathsYou own the resources; provider rules allow most testingReal costs; provider rules still applyFree tools, pay for usage Browser decision labs (PlayCISO)Attack techniques and engagement decisions without any targetNothing real is attackedSimulations, not real exploitationFree ## What are the cloud provider rules for pen testing? All three major providers let you test your own resources without asking first, within limits. As of October 2026: - AWS (penetration testing policy): no prior approval for a list of services including EC2, RDS, Aurora, CloudFront, API Gateway, Lambda, Lightsail, Elastic Beanstalk, ECS and Fargate. Any testing that includes command and control (C2) needs prior approval. Red, blue or purple team exercises, simulated phishing, malware testing and other simulated events need a Simulated Events form submitted at least two weeks before. Denial-of-service (including simulated DoS), flooding, DNS zone walking via Route 53, and S3 bucket or subdomain takeover are prohibited. - Microsoft Azure (Microsoft Cloud Unified Penetration Testing Rules of Engagement): no notification required for Azure, but you must follow the Rules of Engagement: test only your own tenant’s resources, no denial-of-service, no attacks on other customers. The no-notification process applies to Azure only, not to every Microsoft cloud service. - Google Cloud (Cloud Security FAQ): you are not required to contact Google to test your own Google Cloud infrastructure, provided you follow the Acceptable Use Policy and Terms of Service and your tests only affect your own projects. Re-read the policy before every engagement; these pages change. ## What goes in a rules of engagement document? - Authorisation: who approved the test, with their authority to approve it (and third-party consent if hosting or SaaS providers are involved). - Scope: exact IP ranges, domains, applications, accounts and environments in scope. - Out of scope: systems, techniques (for example denial-of-service, social engineering of named people) and data you must not touch. - Methodology: black, grey or white box; reference methods such as NIST SP 800-115 or PTES. - Timing: testing windows and blackout periods. - Data handling: what to do if you find personal or sensitive data; how evidence is stored and destroyed. - Communication: emergency contacts on both sides, a stop-test procedure, and when to report a critical finding immediately. - Reporting: format, severity rating and retest terms. The [Penetration Test Scoping Generator](/tools/penetration-test-scoping) builds this as a downloadable scope and RFP from a short questionnaire. ## How do you simulate phishing and lateral movement safely? - Write it down. Signed rules of engagement that name phishing and lateral movement explicitly, the target groups, and anyone excluded. - Tell the right people. Agree with the SOC or IT whether the test is announced, and set up an escalation path so a real incident is never mistaken for the exercise. - Keep payloads benign. A landing page that explains what the person missed, no real credential capture, and test files such as EICAR rather than live malware. - Isolate lateral movement. Practise in a lab domain such as GOAD, or use ATT&CK-mapped tests (Atomic Red Team, Caldera) in a test environment. On a production network, only within the signed scope. - Measure the right thing. Report rate and time to report matter more than click rate; detection and response time matter more than whether you got domain admin. - Clean up. Remove accounts, tools, scheduled tasks and test files, and document that you did. PlayCISO does not send phishing emails; for the defender side, the [Pick the Phish](/arcade/pick-the-phish) game and the [Kerberos Attack Lab](/tools/kerberos-attack-lab) (detection signals for Kerberoasting, golden tickets and pass-the-ticket) are useful companions. ## Checklist: before any practice or test - Do I own this system, or have written permission from someone who does? - Is the exact scope written down, including what is out of scope? - Have I read the hosting or cloud provider’s testing policy this month? - Is my lab isolated from production and the internet? - Are my payloads benign and my data handling agreed? - Do I know who to call, and how to stop, if something breaks? ## Frequently asked questions ### Is it legal to practise penetration testing? Yes, on systems you own or have explicit written permission to test. Practising on deliberately vulnerable labs (Hack The Box, TryHackMe, PortSwigger Web Security Academy, OffSec Proving Grounds) or on virtual machines you run yourself is legal. Testing anything else without authorisation can be a crime, for example under the US Computer Fraud and Abuse Act or the UK Computer Misuse Act 1990. ### How do I simulate phishing and lateral movement safely? Get written rules of engagement signed by someone with authority, tell the SOC or agree a whitelisting and escalation process, and use benign payloads and a landing page that teaches rather than captures real credentials. Do lateral movement in an isolated lab domain (for example GOAD) or with ATT&CK-mapped tools such as Atomic Red Team in a test environment. Measure report rate and time to report, not just click rate. ### How do I run safe payloads in a sandbox lab? Use an isolated network with no route to production or the internet, snapshot the virtual machines before you start, use benign test files such as the EICAR test string to check that detection fires, and never move samples or tools out of the lab. Cloud labs belong in a separate account or subscription with a budget alert. ### Do I need permission to pen test my own AWS, Azure or Google Cloud account? As of October 2026, none of the three require prior approval for testing your own resources, within their rules. AWS allows testing of listed services without approval but requires approval for command-and-control activity and a Simulated Events form at least two weeks ahead for red team, phishing or malware testing; denial-of-service testing is prohibited. Microsoft does not require notification for Azure but you must follow its Rules of Engagement. Google does not require you to contact it, provided tests stay within your own projects and follow its Acceptable Use Policy. ### What is a rules of engagement document? The written agreement that makes a test legal and safe: who authorised it, exact scope (IP ranges, domains, applications, accounts), what is out of scope, permitted techniques, testing windows, how to handle sensitive data, emergency contacts and a stop procedure, and how findings are reported. Never start without one, even for an internal test.