HackTheBox RoadMap — Phase 1: Reconnaissance (Port Scanning)
Welcome to the first part of my HackTheBox RoadMap series — a structured methodology you can follow to solve any HackTheBox machine, broken into seven repeatable phases. In this first article we cover where every engagement begins: reconnaissance.
The goal of this phase is to discover what services are running on the target. You can use automated tools like NmapAutomator, the ordinary Nmap tool, or Rustscan to perform the scanning.
Firstly: Initial Fast Scan (Nmap)
nmap -sC -sV -vv -oN initial.txt <target_ip>- -sC: runs default scripts.
- -sV: detects service versions.
- -oN: saves output to a file.
- -vv (very verbose): increases the output detail level so Nmap shows results in real-time as it discovers them, instead of waiting until the full scan completes.
- -sA: is an ACK scan. It sends TCP packets with only the ACK flag set to the target ports. It doesn't tell you if a port is open or closed — instead, it tells you whether a firewall is filtering the port or not.
Secondly: Full Port Scan
Scans all 65535 ports. Run this in the background while you work on the results from the initial scan.
nmap -p- -T4 -oN allports.txt <target_ip>Thirdly: UDP Scan (often overlooked)
nmap -sU --top-ports 50 -oN udp.txt <target_ip>What to Note
- Open ports and service versions
- Operating system hints
- Any script output (e.g., anonymous FTP, SMB shares, HTTP titles)
- Seeing Kerberos (88) + LDAP/LDAPS (389/636) + Global Catalog (3268/3269) + DNS (53) + kpasswd (464) + SMB (445/139) together is the unmistakable fingerprint of an Active Directory Domain Controller — no other role runs that exact stack. The moment you recognise it, you stop hunting for a web bug and start hunting for credentials and trust abuse. If 80/443/22 had been open instead, the mindset would have been completely different. Lesson: read the port signature before you touch anything — it tells you which game you're playing.
Next up — Part 2: Service Enumeration, where we spend the most time: enumerating every open service, brute-forcing directories, hunting subdomains, and probing common services.
By CyberAlp0 — CyberSkii — Knowledge That Protects
