HTB Attack Flow Playbook
[!abstract] About this guide The complete workflow now lives in 17 focused notes: passive recon → host discovery → web and service enumeration → foothold → AD and Kerberos → ACL and ADCS abuse → credentials → privilege escalation → lateral movement and pivoting → reporting. This file remains the stable entry point so its aliases and inbound links continue to work.
[!dashboard] Open the workspace Open the HTB Pentest Attack Flow dashboard
The dashboard tracks all 17 notes without sharing the folder’s name, avoiding Make.md’s folder-note collision.
[!warning] Authorized targets only Use this playbook only on systems and networks where you have explicit permission. Keep scope, evidence, timestamps, credentials, target changes, and rollback actions documented throughout the engagement.
Engagement Setup
[!note] Set these once The stage notes use these variables to keep commands readable. Replace every placeholder and confirm the active target before running anything.
export IP="10.10.11.x"
export TARGET="$IP"
export DOMAIN="domain.htb"
export DC="dc01.$DOMAIN"
export LHOST="$(ip -br address show tun0 | awk '{print $3}' | cut -d/ -f1)"
export U="user"
export P="password"printf '%s\t%s %s %s\n' \
"$IP" "$DOMAIN" "$DC" "${DC%%.*}" |
sudo tee -a /etc/hosts[!tip] Kerberos clock skew If authentication returns
KRB_AP_ERR_SKEW, compare your clock with the domain controller before changing tactics. See faketime-cheatsheet for the lab workflow.
Kill Chain
[!tip] How to use the flow Treat each stage as a question, not a mandatory sequence. New credentials, routes, hostnames, or privileges should send you back to the lowest-noise relevant enumeration stage. On an HTB box you may begin at Stage 01; a real engagement or CPTS-style assessment usually begins at Stage 00 and ends only after Stage 11.
Linked Table of Contents
| # | Note | Use it when |
|---|---|---|
| 00 | Attack Flow Dashboard | You want the workspace, progress view, or start page. |
| 01 | Stage 00 — Passive External Recon | You need external assets, identities, DNS, or leaked-source clues. |
| 02 | Stage 01 — Recon and Host Discovery | You need live hosts, ports, services, names, and priorities. |
| 03 | Stage 02 — Web Enumeration and Exploitation | HTTP or HTTPS is part of the attack surface. |
| 04 | Foothold Toolkit — File Transfers | You need to move tools, payloads, or evidence. |
| 05 | Foothold Toolkit — Shells, Payloads, and Metasploit | You need to establish or stabilize a foothold. |
| 06 | Stage 03 — Service Enumeration | SMB, RPC, LDAP, DNS, databases, or another exposed service needs depth. |
| 07 | Stage 04 — Active Directory Enumeration | You have domain context or credentials and need the privilege graph. |
| 08 | Stage 05 — Kerberos Attacks | Kerberos configuration or tickets expose an attack path. |
| 09 | Stage 06 — ACL and Object Abuse | BloodHound or LDAP shows delegated object rights. |
| 10 | Stage 07 — ADCS and Certificate Abuse | A certificate authority or enrollment service is present. |
| 11 | Stage 08 — Password Attacks and Credential Hunting | You need to locate, validate, spray, or crack credential material. |
| 12 | Stage 09 — Privilege Escalation | A Linux or Windows foothold needs local escalation. |
| 13 | Stage 10 — Lateral Movement, Pivoting, and Loot | You need remote execution, routes, tunnels, packet capture, or evidence collection. |
| 14 | Domain Trusts and Cross-Forest | The attack graph crosses a domain or forest boundary. |
| 15 | Stage 11 — Documentation and Reporting | You need logs, evidence, findings, cleanup, or retest structure. |
| 16 | Appendix — Worked Chains | You want compact end-to-end examples. |
| 17 | Tool Index | You know the tool and need its place in the workflow. |
Companion Notes
- Attack-Flow-Guide — phased decision trees.
- Most-Used-Commands — compact raw syntax.
- AD_Pentest_Tools_Cheat_Sheet — Active Directory tooling index.
- Nmap Cheatsheet 2026 — scan design and Nmap reference.
- Credential Hunting — focused credential-discovery workflow.
- Attacking Enterprise Networks — the whole playbook run end to end against INLANEFREIGHT.
[!navigation] Begin Dashboard: HTB Pentest Attack Flow