3.2 Scanning 97 subnets that your client does not know about. Regardless of this, you need to follow a process to ensure the following: You are testing only the approved targets. You are getting as much information as possible before increasing the depth of your attack. You can identify the purposes and types of your targets, that is, what services they provide your client. You have specific information about the versions and types of services that are running on your client's systems. You can categorize your target systems by purpose and resource offering. Once you figure out what your targets are and how many of them may or may not be vulnerable, you will then be able to select your tools and exploitation methods. Not only do poor system scanning and enumeration decrease the efficiency of your testing, but also the extra, unnecessary traffic increases your chances of being detected. In addition, attacking one service with a method designed for another is inefficient and may create an unwanted denial of service (DoS). In general, do not test vulnerabilities unless you have been specifically tasked with that job.