Getting Started with Hack The Box Labs

This blog is still in progress, but here's a preview:

Hack The Box can feel overwhelming at first, especially when you're new to structured penetration testing. In this post I outline how I approach new boxes, what tools I start with, and how I document each step so I can later convert runs into proper writeups.

A simple starting recon flow usually looks like this:

nmap -sC -sV -oN scans/initial.txt 10.10.11.123

From there, I pivot into web enumeration (if ports 80/443 are open), SMB enumeration for Windows boxes, or SSH + service inspection on Linux targets.