Purpose and Scope

This documents my Hack The Box methodology, which is intentionally focused on adversarial system compromise rather than professional penetration testing. HTB machines are treated as hostile environments with no imposed scope beyond achieving initial access and escalating privileges to full system compromise.

The goal is to develop and demonstrate an attacker's mindset: identifying viable entry points, chaining weaknesses, and persisting through incomplete information until root access is achieved. Considerations such as reporting completeness, service stability, or business impact are intentionally deprioritized in favor of technical depth and exploitation efficiency.

This methodology is not intended to represent how I conduct scoped, client-authorized penetration tests. It exists to capture how I approach systems when operating from a purely offensive perspective, where the objective is total compromise rather than structured assessment.

The Process

Reconnaissance

Scan everything, find what's running, identify versions.

nmap -sV -sC -p- -Pn --min-rate 5000 <target>

Full port scan, service enumeration, default scripts. No rate limiting concerns here — HTB machines can handle it.

Subdomain enumeration if there's DNS involved. Directory enumeration on any web services — ffuf or gobuster. Find version numbers. Check for known CVEs. Look for anything unusual.

Initial Access

Figure out the entry point and exploit it. This is where my skills as a web application hacker and bug bounty hunter come in, as I use my web application testing methodology to find critical vulnerabilities that can be used to gain access to the system. The initial foothold into HTB systems is usually a busybox shell or a meterpreter shell, and we need to stabilize the shell for best performance.

Sometimes the initial foothold is using a critical vulnerability to dump info from backend tables that reveal credentials, sometimes giving a path to use SSH to log in to the machine.

Common vectors: web vulnerabilities (SQLi, command injection, file upload, LFI/RFI, template injection), service exploits for specific versions, default credentials, misconfigurations.

Get a reverse shell, stabilize it:

python -c 'import pty; pty.spawn("/bin/bash")'

Privilege Escalation

Once in as a low-privilege user, enumerate the system.

Linux:

  • LinPEAS for automated enumeration
  • Check SUID binaries, sudo privileges, cron jobs
  • Search for credentials in config files, bash history, databases

Windows:

  • WinPEAS for automated enumeration
  • Token impersonation (very common)
  • Service misconfigurations, scheduled tasks
  • Credential hunting in registry and config files

Active Directory:

  • BloodHound for attack path mapping
  • Kerberoasting, AS-REP roasting
  • Credential dumping with Mimikatz
  • Look for weak ACLs, delegation issues
  • Pass-the-hash when needed

When Stuck

Go back and enumerate more. Check what you missed. If still testing for web vulnerabilities and a way in, make sure you go through the OWASP Top 10 when trying to find that initial crack in the armor.

Most easy machines you can find a critical CVE affecting the machine with a Nuclei scan, but medium, hard, and insane machines require a deep understanding of the OWASP Top 10 and a solid web testing methodology.

Don't overlook downloadable source code from machines. This is gold for writing custom exploits. For example, in a machine I recently did, after downloading the source code for a website that allowed users to upload browser extensions, I could actually see in the source code how to chain an SSRF vulnerability with a command injection vulnerability to gain access.

Once a reverse shell is established, try the simple things — default credentials, obvious misconfigurations, checking sudo -l right after getting a shell.

Tools

Scanning & Enumeration: Nmap, Gobuster, ffuf, Nuclei, various subdomain/DNS tools

Web Testing: Burp Suite, SQLmap, custom Python scripts, Metasploit

Exploitation: Metasploit, Searchsploit/ExploitDB, custom exploits, Netcat, Python HTTP server

Post-Exploitation: LinPEAS, WinPEAS, BloodHound, Mimikatz, enumeration scripts

Credential Attacks: Hashcat, John the Ripper, Hydra, Kerbrute

Custom Tools: Python scripts for specific vulnerabilities, automation, niche exploits that don't have existing tools. Built or modified as needed.

Difficulty Breakdown

Easy: Straightforward vulnerabilities, clear exploitation paths

Medium: Chain multiple vulnerabilities, deeper enumeration required

Hard: Obscure techniques, multiple privilege escalation steps, sometimes custom exploits

Insane: All of the above plus additional complexity, deep understanding of specific technologies

What I've Learned

  • Enumeration is everything. When stuck, enumerate more.
  • Version numbers matter — specific versions have known exploits.
  • Check the simple stuff first — software versions with known vulnerabilities, default credentials, sudo -l immediately after shell access, obvious misconfigurations.
  • Take notes. Easy to forget what you already tried.
  • Stabilize shells immediately.

Resources

  • HackTricks (comprehensive techniques)
  • PayloadsAllTheThings (exploit payloads)
  • RevShells (reverse shell generator)
  • ExploitDB (public exploits)

Detailed machine writeups with the problem-solving process are in the Writeups section.

← Back to Blog