A municipal RoE lists exact CIDR blocks allowed for lateral movement. The tester’s tunnel can technically reach an unlisted research segment. What should they do?
Select an answer to reveal the explanation.
Short Explanation
Having a ladder that can touch the neighbor’s roof does not mean you are allowed to climb onto it. RoE CIDR lists are the property lines for lateral movement. Spotting an unlisted path is useful intel to flag—not a free pass to tunnel there.
Full Explanation
Rules of engagement define authorized networks for pivoting and tunneling. Technical reachability through a foothold does not expand written scope. Testers should confine lateral paths to approved CIDRs and communicate newly discovered adjacent routes for explicit confirmation. Expanding tunnels into unlisted segments is a scope violation even when connectivity exists.