opsec

name	opsec
description	Operational security — scan rate limits, user-agent rotation, traffic shaping, evidence handling, detection awareness, scope enforcement, and anti-detection patterns for bug bounty and VAPT engagements.

Operational Security (OPSEC)

OPSEC keeps the engagement covert, controlled, and within authorized scope. Poor OPSEC triggers WAF/IDS, burns the engagement, taints findings, and can get your account banned on bug bounty platforms.

Pre-Engagement Checklist

Before ANY active operation:

• Written authorization (RoE, program policy, or signed SOW) confirmed
• In-scope asset list extracted and written down
• Out-of-scope list explicitly noted
• Testing window defined (for VAPT engagements)
• Emergency contact accessible (for VAPT engagements)

Scan Rate Limits

Target Type	Recommended Rate	Tool Flag
Production web server	5-10 req/sec	ffuf -rate 5
Bug bounty target	10-20 req/sec	nuclei -rl 10
Internal network (VAPT)	50-100 req/sec	nmap -T3
WAF-protected	1-5 req/sec	custom delays
High-security target	1-2 req/sec	nmap -T1

# ffuf with rate limiting
ffuf -u https://TARGET/FUZZ -w wordlist.txt -rate 10 -p 0.1

# nuclei conservative
nuclei -u https://TARGET -rl 5 -c 2 -timeout 10

# nmap conservative
nmap -sS --max-rate 10 --max-retries 1 -p 80,443,8080,8443 TARGET

# curl loop with delay
while read url; do
    curl -s -o /dev/null -w "%{http_code} $url\n" "$url"
    sleep 0.2
done < urls.txt

User-Agent Rotation

Tool default user-agents are logged and flagged. Always override.

# Current UA examples — update version numbers to match current stable releases
UA_LIST=(
    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0 Safari/537.36"
    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/131.0.0.0 Safari/537.36"
    "Mozilla/5.0 (X11; Linux x86_64; rv:132.0) Gecko/20100101 Firefox/132.0"
)
UA="${UA_LIST[$RANDOM % ${#UA_LIST[@]}]}"

# Apply to tools:
curl -s -A "$UA" https://TARGET/
ffuf -u https://TARGET/FUZZ -w list.txt -H "User-Agent: $UA"
nuclei -u https://TARGET -H "User-Agent: $UA"

Headers that expose scanner identity:

• "Nmap Scripting Engine" — nmap default
• "nikto" — nikto default
• "gobuster" — gobuster default
• "sqlmap" — sqlmap default

Traffic Shaping

Timing matters:

• Business hours (9am-5pm target TZ) → scans blend with user traffic
• Weekends/holidays → lower baseline, scans stand out
• Burst → pause → burst: less detectable than sustained scanning

Randomize wordlists and host order:

# Randomize wordlist order before ffuf
shuf wordlist.txt > wordlist_rand.txt

# Randomize nmap host order (VAPT multi-host)
nmap -sS --randomize-hosts -iL targets.txt

# Random delay between requests (0.1 to 0.5 sec)
ffuf -u https://TARGET/FUZZ -w list.txt -p '0.1-0.5'

Tool Signature Reduction

Tool	Signature	Mitigation
nmap	SYN pattern, probe ordering	-T2, --data-length 24, -g 53
nuclei	Template-specific payloads	-rl 5, selective templates -t
ffuf	Rapid sequential requests	-rate, -p delay
sqlmap	Parameter tampering patterns	--delay=2, --level=1
dirsearch	Sequential path enum	--random-agent, --delay=0.3

# nmap with obfuscation
nmap -sS --data-length 24 -T2 TARGET          # Random packet padding
nmap -sS -g 53 TARGET                          # Appear as DNS traffic
nmap -sS -g 80 TARGET                          # Appear as HTTP traffic

Detection Indicators

Signs you've been detected:

• Connection resets — firewall rule just added
• 429 responses where 200s were before — WAF triggered
• Timeouts on previously responsive hosts — IP banned
• Unusually permissive targets — possible honeypot
• Extremely slow responses — tarpit, deliberately slowing scanner

Response to detection:

1. Pause all scanning — at least 30 minutes
2. Review recent scan patterns for what triggered it
3. Reduce rate by 50-75%
4. Switch to passive-only for a period
5. Document detection event

Evidence Handling

## Engagement Action Log

| Timestamp (UTC)    | Action          | Target            | Tool    | Justification            |
|--------------------|-----------------|-------------------|---------|--------------------------|
| 2026-04-22 14:23   | Subdomain enum  | example.com       | subfinder | In-scope root domain  |
| 2026-04-22 14:31   | Dir fuzzing     | api.example.com   | ffuf    | Live host, 443 open      |

Data rules:

• Credentials found → document, never store plaintext
• PII discovered → note existence, do not exfiltrate
• All scan output → recon/<target>/ directory

Scope Enforcement

# Before testing, verify target is in scope
SCOPE_FILE="scope.txt"
TARGET="api.target.com"

if grep -qF "$TARGET" "$SCOPE_FILE"; then
    echo "IN SCOPE — proceed"
else
    echo "WARNING: $TARGET not in scope file — verify before proceeding"
fi

Scope boundaries:

• Domains: only enumerate subdomains of authorized root domains
• Wildcards: *.target.com does NOT cover target.com itself
• Cloud: only test resources confirmed as client-owned
• Third-party: CDNs, SaaS platforms, shared infra are out of scope
• Accidental out-of-scope: stop, document, notify lead — do NOT clean up evidence

Bug Bounty OPSEC Specifics

Unlike VAPT, bug bounty targets are not aware of testing. Extra constraints:

• Never use automated scanners on endpoints that accept payments, send emails, or affect other users
• Use --dry-run or --simulate flags when available
• Test on staging/dev instances when possible
• Keep request volume proportional to what a power user would generate
• One test account per target — do not create multiple accounts unless the program explicitly allows it
• Never store or exfiltrate user data found during testing, even as proof