Operator Tradecraft Nobody Teaches You

Courses teach techniques. Nobody teaches the working habits that keep professional testers organized, defensible, and trusted with client data. These are the ones you only learn after something goes wrong.

Log every command with a timestamp

If a client asks “what did you run against our server at 14:32 on Tuesday?”, you need an answer. Put a timestamp in your prompt:

# ~/.zshrc
PROMPT='%F{green}[%D{%Y-%m-%d %H:%M:%S}]%f %F{cyan}%~%f $ '

Then record whole sessions to disk:

script -q -a ~/engagements/acme/logs/$(date +%F_%H%M).log

Both cost nothing and have saved many testers when an outage happens to coincide with their test window. Logs prove what you did, and what you didn’t.

One engagement, one environment

• Use a fresh VM or container per client, built from a snapshot. Client data never mixes, and you start every job from a known-good state.
• Keep a standard folder layout so your tools and notes always land in the same place:

engagements/acme-2026-11/
├── scope/          # signed authorization, rules of engagement, IP lists
├── scans/          # raw tool output, never edited
├── loot/           # credentials and sensitive findings (encrypted)
├── evidence/       # screenshots, request and response pairs
├── notes.md
└── report/

• Store the signed authorization in the engagement folder before any traffic leaves your machine.

Check scope before every new target

Scope drift is the most common way honest testers get into trouble. A quick check against your scope file prevents it:

grep -Fxq "$TARGET" scope/in-scope.txt && echo "IN SCOPE" || echo "NOT IN SCOPE, STOP"

DNS can change mid-engagement. Re-resolve hostnames and confirm the IP still belongs to the client, especially for cloud assets, where an IP can be reassigned to a different customer overnight.

Handle client data like it’s radioactive

• Encrypt the loot/ directory, for example with age or an encrypted volume.
• Prove impact with the minimum data. One redacted record makes the point. A full database dump creates liability.
• Redact secrets in screenshots before they go into the report, not after.
• Securely delete engagement data when your contract says to, and document that you did.

Notes that write the report for you

Take notes as if someone else will write the report from them, because future you is someone else. For every finding, capture:

• What you saw, and the exact request and response.
• When, using the timestamp from your prompt.
• Why it matters in business terms.
• How to reproduce it, step by step.

Testers who do this finish reports in hours instead of days.

Know when to stop and call

Agree before the test starts on what triggers an immediate phone call to the client: finding evidence of a real prior compromise, discovering critical exposure of personal data, or accidentally causing instability. Stopping and reporting is always the professional move.

Small tools, big quality-of-life wins

Tool	Why
tmux	Sessions survive disconnects. Split panes for scan output and notes.
jq	Slice the JSON output that most modern tools produce.
rlwrap	Adds history and arrow keys to bare interactive tools.
asciinema	Records terminal sessions you can replay as evidence or for training.
Flameshot	Annotated screenshots in two keystrokes.