You are conducting a penetration test for a private company located in Canada. The scope extends to all internal-facing hosts controlled by the company. You have gathered necessary hold-harmless and n

Analyzing internal firewall or router software for vulnerabilities is passive reconnaissance that does not involve intercepting communications and falls within the agreed scope.

Exploiting application vulnerabilities on in-scope end-user workstations is a standard authorized pentest activity covered by the hold-harmless agreement.

Attempting to crack passwords on an in-scope development server is an authorized activity under a properly executed penetration testing agreement.

Section 184 of the Criminal Code of Canada makes it illegal to willfully intercept private communications without the consent of at least one party to the communication. Section 542 extends similar protections to radio-based and packet-based communications such as VoIP. Capturing a VoIP call that involves a third party outside the scope of the engagement violates these statutes because the hold-harmless agreement only covers the hiring company and its assets - not third-party callers who have not consented.