Approaching a Target

A repeatable loop beats guessing. Enumerate, foothold, escalate, flag.

16 minmethodologyctfworkflow

What you will learn

-Run the four-phase loop that roots most boxes
-Structure notes so you never lose a finding
-Recognize that stuck almost always means under-enumerated

A CTF box is not a riddle you crack by inspiration. It is a , and systems give way to process. The players who machines consistently are not smarter than you. They are more methodical. Every target, from an easy warmup to a hard insane-rated box, yields to the same loop.

The loop

Four phases, always in this order:

Enumerate. Map everything the target exposes: open , service versions, web pages, usernames, readable files. You cannot attack what you have not found.
Foothold. Turn one finding into code execution. A vulnerable service, a default , an unrestricted upload. The goal is a as any user, however weak.
Escalate. Go from that first low-privilege user to root or SYSTEM. Re-enumerate, this time from the inside.
Flag. Collect the proof. Usually user.txt in a home and root.txt in /root.

The trap beginners fall into is jumping straight to phase 2, firing at the first open port they see. Discipline is doing phase 1 completely before you touch phase 2.

Enumeration is the whole game

Start every box the same way: a full picture of what is . A fast port sweep tells you what is open, then a targeted version scan tells you what it is.

attacker@kali

# set the target once, reuse everywhere

$export IP=10.10.10.5

# all 65535 ports, fast, just find what is open

$nmap -p- --min-rate 1000 $IP

# default scripts plus versions on the open ports

$nmap -sC -sV -p 22,80,445 $IP

ScannerTarget :443

probeSYN

replySYN-ACK

Scanner sees: SYN-ACK returned
What it means: A service is listening. This is your way in. Fingerprint it next.

Take notes like it is evidence

The single habit that separates people who finish boxes from people who spin out is note-taking. Give every target its own folder before you scan. the IP, every open port and version, every credential you find, and every command that actually worked. When you land a shell three hours in and need that you saw in phase 1, it will be one grep away instead of gone.

attacker@kali

# one home per box

$mkdir -p ~/boxes/target/{scans,loot,exploits}

# -oA saves all three output formats

$nmap -sC -sV -p- -oA ~/boxes/target/scans/full $IP

Stuck means under-enumerated

When you hit a wall, resist the urge to hunt for a fancier exploit. Nine times out of ten you missed something: a virtual , a second port, a comment in page source, a subdirectory. Go back to phase 1 and look harder.

You just got a low-privilege shell on the box. Which phase are you in, and what comes next?

Exercise

Name the nmap flag that saves output in all formats at once so your notes folder captures the scan automatically.

Think about the flag that writes normal, XML, and grepable output together under one base filename.

From Enumeration to Foothold

The loop

Four phases, always in this order:

Enumerate. Map everything the target exposes: open , service versions, web pages, usernames, readable files. You cannot attack what you have not found.

Foothold. Turn one finding into code execution. A vulnerable service, a default , an unrestricted upload. The goal is a as any user, however weak.

Escalate. Go from that first low-privilege user to root or SYSTEM. Re-enumerate, this time from the inside.

Flag. Collect the proof. Usually user.txt in a home and root.txt in /root.

The trap beginners fall into is jumping straight to phase 2, firing at the first open port they see. Discipline is doing phase 1 completely before you touch phase 2.

Enumeration is the whole game

Start every box the same way: a full picture of what is . A fast port sweep tells you what is open, then a targeted version scan tells you what it is.

attacker@kali

# set the target once, reuse everywhere

$export IP=10.10.10.5

# all 65535 ports, fast, just find what is open

$nmap -p- --min-rate 1000 $IP

# default scripts plus versions on the open ports

$nmap -sC -sV -p 22,80,445 $IP

ScannerTarget :443

probeSYN

replySYN-ACK

Scanner sees: SYN-ACK returned
What it means: A service is listening. This is your way in. Fingerprint it next.

Take notes like it is evidence

attacker@kali

# one home per box

$mkdir -p ~/boxes/target/{scans,loot,exploits}

# -oA saves all three output formats

$nmap -sC -sV -p- -oA ~/boxes/target/scans/full $IP

Stuck means under-enumerated

You just got a low-privilege shell on the box. Which phase are you in, and what comes next?

Exercise

Name the nmap flag that saves output in all formats at once so your notes folder captures the scan automatically.

Think about the flag that writes normal, XML, and grepable output together under one base filename.