Attacking Enterprise Networks (HTB) #1 Reconnaissance

Introduction

In this series, I’ll document my approach to attacking an enterprise-style environment in Hack The Box, following a methodology similar to an external/internal penetration test. In this first part, I’ll focus exclusively on reconnaissance: identifying exposed infrastructure, discovering virtual hosts, enumerating services, and building an initial attack-surface map.

Scenario

The customer has asked us to identify as many vulnerabilities as possible; therefore, evasive testing is not required.

Scope

The client has not provided web application, VPN, or Active Directory user credentials. The following domain and network ranges are in scope for testing:

External Testing :

• 10.129.x.x ("external" facing target host)
• *.inlanefreight.local (all subdomains)

Internal Testing:

• 172.16.8.0/23
• 172.16.9.0/23
• INLANEFREIGHT.LOCAL (Active Directory domain)

Automated testing techniques such as enumeration and vulnerability scanning are permitted, but we must work carefully not to cause any service disruptions. The following are out of scope for this assessment:

• Phishing/Social Engineering against any Inlanefreight employees or customers
• Physical attacks against Inlanefreight facilities
• Destructive actions or Denial of Service (DoS) testing
• Modifications to the environment without written consent from authorized Inlanefreight IT staff

Enumeration

Subdomain Enumeration:

I started with Subdomain Brute-forcing and virtual-host enumeration. The goal was to identify applications that may not be directly linked from the main website.

Commands used:

DNS Zone Transfers:

I first checked whether the authoritative DNS server permitted an unauthenticated AXFR request. If misconfigured, a zone transfer can disclose the DNS records for an entire zone, providing a useful map of hosts and services.

dig axfr @inlanefreight.local inlanefreight.local

Virtual Host (VHost) Fuzzing:

Virtual-host enumeration does not necessarily discover DNS records. Instead, it tests how the web server responds to different Host headers, which can reveal applications configured on the same IP but not publicly advertised through DNS.

Get 0xBOoMa’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

VHost fuzzing → Public AND private subdomains on same IP (no DNS record needed)

gobuster vhost -u http://inlanefreight.local/ -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain

ffuf → performs another virtual-host discovery pass using a different wordlist and response-size filtering.

ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://inlanefreight.local/ -H 'Host: FUZZ.inlanefreight.local' -fs 15157

Results:

• inlanefreight.local
• dev.inlanefreight.local
• vpn.inlanefreight.local
• support.inlanefreight.local
• status.inlanefreight.local
• monitoring.inlanefreight.local
• careers.inlanefreight.local
• tracking.inlanefreight.local
• ir.inlanefreight.local
• gitlab.inlanefreight.local
• ns1.inlanfreight.local
• dnsadmin.inlanefreight.local
• flag.inlanefreight.local
• blog.inlanefreight.local

Port Scanning & Web Service Discovery

Scan every resolved subdomain and IP.

Always save output as XML — it feeds directly into the screenshot tools.

Commands used:

I first focused on commonly used HTTP/HTTPS and alternative web ports. The objective was to quickly identify web applications across all discovered hosts before performing broader service enumeration.

sudo nmap -p 80,443,8000,8080,8180,8443,8888,8089,10000 --open -oA web_discovery -iL subdomains

Application Discovery & Screenshot Reports

• Run against Nmap XML

eyewitness --web -x web_discovery.xml -d eyewitness_report

Port Scanning & Service Discovery

• Top 10,000 ports scan (run while reviewing screenshot reports)

sudo nmap -sV --top-ports 10000 -oA top10k 10.129.229.147

Results:

PORT     STATE SERVICE  VERSION
21/tcp   open  ftp      vsftpd 3.0.3
22/tcp   open  ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
25/tcp   open  smtp     Postfix smtpd
53/tcp   open  domain   (unknown banner: 1337_HTB_DNS)
80/tcp   open  http     Apache httpd 2.4.41 ((Ubuntu))
110/tcp  open  pop3     Dovecot pop3d
111/tcp  open  rpcbind  2-4 (RPC #100000)
143/tcp  open  imap     Dovecot imapd (Ubuntu)
993/tcp  open  ssl/imap Dovecot imapd (Ubuntu)
995/tcp  open  ssl/pop3 Dovecot pop3d
8080/tcp open  http     Apache httpd 2.4.41 ((Ubuntu))

Initial service assessment

The target exposes several distinct service categories:

• File transfer: FTP
• Remote administration: SSH
• Mail: SMTP, POP3 and IMAP
• DNS: DNS
• Web: HTTP on ports 80 and 8080
• RPC: rpcbind

The combination of HTTP services and multiple mail protocols provides several potential enumeration paths. FTP should also be checked for anonymous access, while DNS configuration and SMTP capabilities may provide additional information about the environment.

Conclusion

The reconnaissance phase revealed a significantly larger attack surface than the initial target alone suggested. Virtual-host enumeration identified multiple applications and infrastructure-related subdomains, while service enumeration exposed web, mail, DNS, FTP, SSH and RPC services.

With this information collected, the next phase can focus on deeper enumeration of the most interesting applications and services, correlating information between them and identifying potential paths toward initial access.