Step 273. HTB Hard Challenge 1 — Enumerate Deeper, Test Hypotheses

Level 3 — Real-World CTF & Advanced Offensive Skills | Difficulty ★★★★★ | Estimated time: 1 week (timeboxed)

Prerequisites: Step 270 (HTB Medium five-machine graduation review) and Step 272 (penetration playbook v1.0).

What you need: an HTB account with a VPN connection, your playbook — and this time, one more thing: a hypothesis tracker.
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. Hack The Box (hackthebox.com) is a legal learning platform officially opened by its operators for attack practice — do not use today’s techniques on anything except HTB machines.
About the screens: every HTB connection screen and command output in this chapter is a screen example. You make the actual connections and do the actual solving yourself.
About the goal: the goal of your first Hard is not completion but learning the process. One-week timebox; finishing is a bonus.

Hard is not an extension of Medium. With the routine that carried you through Medium, you may not even see the entrance — because "techniques you don’t know + a hidden entrance + a multi-stage chain" stack on top of each other. In fact, spending three days on your first Hard staring at nothing but a port-scan screen is not a tragedy; it’s the standard experience.

That’s why the core skill for Hard is not a new technique but hypothesis management — enumerating every possible path, sorting them by probability, breaking them one by one, and recording the results. It’s less a technique than the scientific method. Today you take that method and throw yourself bodily at the wall of your first Hard.

1. Learning Objectives

By the end of this chapter, you will be able to:

Explain the three traits that make Hard different from Medium (unknown techniques, hidden entrances, multi-stage chains)
Execute the concrete moves of "deep enumeration" (full UDP scans, large wordlists, vhosts, source reading)
Create and operate a hypothesis tracker (path list → priorities → verification results)
Make a habit of the session-end record ("hypotheses busted / hypotheses remaining / tomorrow’s first move")
Distill "what Hard demands" into sentences through a one-week attack log and retrospective

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	HTB platform (VPN) + attack machine + playbook (Step 272)
Today’s commands	`nmap -sU` (UDP), large-wordlist scans, `ffuf` vhost, source reading
Concepts needed	The hypothesis-test cycle, hypothesis tracker, probability ordering, enumeration regression
Today’s deliverable	One-week attack log + hypothesis tracker + weekly retrospective (finishing is a bonus)

2-1. The Three Traits of Hard

First, old patterns stop working. Entrances that worked on Medium — "directory scan → backup file" — are known to Hard authors too. So the entrance is hidden outside the usual lists: a service open only on UDP, a domain behind a vhost, logic visible only by reading source.

Second, the number of hypotheses explodes. On Medium the "possible paths" numbered three or four; on Hard there are more than ten. Manage them in your head and you will inevitably verify the same one twice or skip the important one.

Third, the chains are long. Step 269’s two-stage chain becomes four or five stages on Hard, and one of the middle links may be a technique you don’t know yet. What you need then is not giving up but "studying just that link, separately."

2-2. The Concrete Methods of "Deep Enumeration"

On Hard, "enumerate harder" is not a slogan but a list of concrete commands.

Dimension	Medium level	Hard level
TCP ports	`-sV -sC` + all ports	Dig into every service from the all-ports result, one by one
UDP	Skipped or top 20	`-sU --top-ports 100` or more; check SNMP and DNS individually
Web lists	common.txt (~4,000)	raft-medium or larger (tens of thousands), extension combinations
Domains	One host	vhost and subdomain fuzzing
Code	Read responses only	Full read of any source obtained; careful read of JS files

The common principle is one — "don’t use the list defaults." Authors hide things that aren’t in the default lists.

2-3. The Hypothesis Tracker — Hard’s Ship Log

Four columns are enough for a hypothesis tracker.

| # | Hypothesis (path) | Basis | Status |
|---|-------------------|-------|--------|
| 1 | Community string from UDP 161 SNMP | Open in UDP scan | Testing |
| 2 | Hidden domains via vhost fuzzing | Domain hint in port 80 response | Busted — found 3 |
| 3 | Credentials in web source comments | Odd string in JS file | Rejected — joke string |
| 4 | FTP anonymous login | 21 open | Pending |

Three rules. ① Number every hypothesis the moment you find it. ② Close every verification clearly as "busted/rejected" — treat "ambiguous" as rejected and write down the basis. ③ When new information arrives, re-prioritize the entire table.

2-4. The Session-End Record — The Baton You Hand to Tomorrow’s You

Hard doesn’t finish in a day. In an assault spanning multiple sessions, memory inevitably evaporates, so at the end of every session you write three lines.

[Day 3 end]
- Busted today: #2 found 3 vhosts, #5 rejected (identical response sizes)
- Remaining: #1 (SNMP, in progress), #4, #7 (new)
- Tomorrow's first move: onesixtyone against #1 for community strings

"Tomorrow’s first move" is the heart of this record. With it, the warm-up time of your next session shrinks from 30 minutes to 3; without it, every session starts with "where was I again?"

2-5. Repeating the Same Hypothesis Is the Signal to Regress to Enumeration

Being stuck for three days on Hard is normal. But you must distinguish — being stuck while testing new hypotheses is progress; being stuck while re-testing the same hypothesis is stagnation. The latter means "the information I have can’t differentiate the hypotheses any further," and there’s exactly one prescription — regress to enumeration and bring back new information.

3. Follow Along

3-1. Choosing a Machine and Declaring the Timebox

Pick one Hard machine on HTB with good ratings (high community rating). For your first Hard, a machine with well-documented lessons beats a technique-showcase machine — because later you can compare the official write-up against your own process.

Then declare it on your calendar — a one-week timebox. Whether it’s 1–2 hours a day or a weekend binge is up to you, but you must fix the "end" for a retrospective to exist.

3-2. Day 1 — Deep Enumeration

Spend the entire first session on enumeration. Not finding an entrance on day one of a Hard is not failure — it’s by design.

TCP and UDP simultaneously (screen example):

nmap -sV -sC 10.10.11.xx -oN tcp_default.txt
nmap -p- --min-rate 2000 10.10.11.xx -oN tcp_all.txt
sudo nmap -sU --top-ports 100 10.10.11.xx -oN udp_top100.txt

# udp_top100.txt (screen example)
PORT    STATE         SERVICE
161/udp open          snmp

If you see a web service, enlarge the lists (screen example):

gobuster dir -u http://10.10.11.xx 
  -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
ffuf -u http://10.10.11.xx -H "Host: FUZZ.targetdomain" 
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

How to read it: what used to appear with common.txt on Medium now appears only with raft; the service visible only after opening UDP (SNMP) is the first link of the chain — this is the substance of "deep enumeration." Everything you discover today goes to the asset inventory (Step 269), and every possible path gets a number in the hypothesis tracker.

3-3. Day 2 Onward — The Hypothesis-Test Loop

From day two, the rhythm is fixed.

Start with yesterday’s "tomorrow’s first move"
Pick the top hypothesis from the tracker and design a decisive experiment — decide in advance "if I see this, it’s busted; otherwise, rejected"
Record the result in the table and re-prioritize
On detecting stagnation (repeating the same hypothesis), regress to enumeration

An example of a decisive experiment (screen example) — verifying SNMP hypothesis #1:

onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt 10.10.11.xx

Scanning 1 hosts, 120 communities
10.10.11.xx [public] Linux web01 5.10.0 ...

A response came back with public, so hypothesis #1 is "busted" — and the new information (hostname web01, kernel version) is stocked into the asset inventory, and from that information a new hypothesis (#7: enumerate the process list via SNMP) is spawned. This cycle, where hypotheses beget hypotheses, is what real progress looks like on Hard.

3-4. When You Meet a Technique You Don’t Know — Link-Isolation Study

If an unknown technique sits in the middle of the chain (e.g., the path demands "an exploit for CVE-2024-xxxx against this service"), pause the assault and isolate just that link for study.

Write a one-page concept document in your wiki (the three-box structure from Step 89)
If possible, practice just that technique in a local lab or a related THM room
Note it as an unverified card in your playbook (Step 272), and attach the link once it’s verified on this machine

It’s no coincidence that one Hard machine demands more study than three Mediums — Hard is designed as "a device for discovering what you don’t know."

3-5. The Closing Ritual of Every Session

Before closing a session, write the three lines from 2-4 in your attack log. Then scan the hypothesis tracker once and check: "new information arrived today — are the priorities still the same?"

The reward of this ritual arrives on day three — while others are retracing "what did I see two days ago," you read the last line of your log and start the experiment immediately.

3-6. Day 7 — A Weekly Retrospective Regardless of Completion

When the timebox ends, hold a retrospective regardless of the outcome. If you finished, review the process; if you didn’t, place the official write-up and your hypothesis tracker side by side and compare.

Three comparison questions:

Was the correct path on my hypothesis tracker? — If yes, it’s an ordering problem; if no, it’s an enumeration problem.
Was a hypothesis I rejected actually the answer? — Check whether the rejection basis was hasty. If rejecting "ambiguous" was the cause, adjust your rejection criteria.
In one sentence, what did this Hard demand? — e.g., "beyond the default wordlists," "don’t give up on UDP," "read the source to the end."

These sentences become the starting point of your next Hard challenge (Step 274 onward).

4. Missions & Exercises

Mission — The First Week of Your First Hard

Pick a well-rated Hard machine and declare a one-week timebox
On Day 1, execute every item of "deep enumeration" (UDP, large wordlists, vhosts)
Operate the hypothesis tracker — a number for every path, a busted/rejected verdict for every test
Leave a session-end record ("busted / remaining / tomorrow’s first move") every session
On Day 7, a weekly retrospective — compare the correct path against your tracker + one sentence on "what Hard demands"

Exercises

Exercise 1. For each of Hard’s three traits (unknown techniques, hidden entrances, multi-stage chains), name the countermeasure it demands.

Exercise 2. Explain, from the author’s point of view, why "don’t use the list defaults" — the common principle of deep enumeration — holds.

Exercise 3. Explain why the hypothesis tracker must not allow an "ambiguous" state and must close everything as busted/rejected.

Exercise 4. Explain the difference between "stuck on new hypotheses" and "stuck on the same hypothesis," and the prescription for the latter.

5. Model Answers & Completion Criteria

Mission Model Answer

Grading targets the process artifacts, not completion. Numbered hypotheses in the tracker, a verdict on each hypothesis, a session-end record per session, and the Day 7 comparison retrospective. If you finished, adding a path diagram (Step 269) makes it perfect.

How to verify: ① Does every hypothesis in the tracker end in a verdict, with none left as "pending/testing" (unverified ones on the last day must say so explicitly)? ② Are there as many session-end records as sessions? ③ Is there an answer to retrospective question 1 (was the answer on my tracker)? ④ Is the "what Hard demands" sentence concrete ("make full UDP scans a default," not "try harder")?

Exercise Answers

Answer 1. For unknown techniques: "link-isolation study" — detach that link from the chain, write your own concept document, and practice it. For hidden entrances: "deep enumeration" — look outside the default lists with UDP, large wordlists, and vhosts. For multi-stage chains: "the asset inventory and hypothesis tracker" — manage the long chain’s parts and paths as documents, not memory.

Answer 2. Authors know the default lists too. If an entrance were a path in common.txt, the machine would be Medium. To make a Hard a Hard, the entrance must be hidden where the default lists don’t reach — a path only in big wordlists, a UDP service, behind a vhost. So the attacker must read "didn’t show up with defaults" not as "doesn’t exist" but as "I’ve only seen the defaults so far."

Answer 3. "Ambiguous" means verification hasn’t ended; left in the table, it gets verified again later — and that is "repeating the same hypothesis," Hard’s greatest time thief. Closing as busted/rejected makes the table’s remaining count reflect the actual amount of work left. If the basis is weak and rejection feels uneasy, close it as "rejected (weak basis)" and note the basis.

Answer 4. Testing a new hypothesis is progress because hypotheses get erased from the table one by one even when they fail. Repeating the same hypothesis is stagnation where the table doesn’t shrink — a signal that "the information I have can’t differentiate the hypotheses further." The prescription is not squeezing out more hypotheses but regressing to enumeration to bring back new information — new information births new hypotheses (or rejection grounds).

Completion Criteria Checklist

[ ] I can explain Hard’s three traits and the countermeasure for each
[ ] I actually ran UDP scans, large wordlists, and vhost fuzzing
[ ] I operated the hypothesis tracker (numbers, basis, busted/rejected verdicts) for a week
[ ] I left the three-line session-end record every session
[ ] I actually triggered the enumeration-regression rule at least once when stagnating
[ ] I responded to unknown techniques with link-isolation study
[ ] Mission: I completed the one-week attack log + hypothesis tracker + weekly retrospective

6. Common Pitfalls & Fixes

Wall 1. Guilt over "wasting" day one on scans alone

Symptom: you found no entrance on Day 1 and feel like "I accomplished nothing today."
Cause: you’re measuring Hard progress with Medium instincts.
Fix: on Hard, a day of enumeration is progress — if five numbered hypotheses appeared in the tracker, that is today’s product. Read it not as failure but as "five hypotheses to bust tomorrow."

Wall 2. Hundreds of hits in vhost fuzzing

Symptom: every ffuf result looks like a success.
Cause: the server returns the same response (same size) even for vhosts that don’t exist. A fuzzing constant.
Fix: filter by response size — like -fs 4242 (exclude size 4242); exclude the size most responses hit and only real vhosts remain. ffuf also auto-calibrates (-ac).

Wall 3. The UDP scan never ends

Symptom: nmap -sU has been running for hours.
Cause: UDP retransmits and waits when there’s no response, so it’s far slower than TCP. This is normal.
Fix: limit the scope with --top-ports 100, and run it in the background while you work the TCP side in parallel. The UDP services that become hints on Hard — SNMP (161), DNS (53), NTP (123) — are a fixed handful.

Wall 4. Day-three doubts: "is there even an answer?"

Symptom: every hypothesis is rejected and your confidence collapses.
Cause: Hard’s difficulty design itself induces that doubt. And being stuck for three days is a stretch this book explicitly labels "normal."
Fix: check two things — ① are all rejections "rejections with a basis" (if so, you’re doing well)? ② have you triggered enumeration regression (if not, do it now)? If you’re still stuck, the community’s spoiler-free hints (direction hints on the official forum) are within bounds — getting a direction is different from seeing the answer.

Wall 5. Reading the official write-up and despairing: "how would anyone think of that?"

Symptom: in the Day 7 comparison, the correct path’s idea looks absurdly unconventional.
Cause: a write-up shows only the path that worked — the dozens of hypotheses the author discarded are invisible.
Fix: change the comparison standard — not "did I produce the answer" but "was the correct path among my tracker’s candidates." If it was a candidate, your problem is not ideation but ordering (priorities), and that’s the kind that experience fixes. If it wasn’t even a candidate, it’s time to add that technique to your enumeration system — and that addition is today’s harvest.

7. Summary

Today’s Concepts

Concept	One-line explanation
Hard’s three traits	Unknown techniques + hidden entrances + multi-stage chains — the Medium routine may not even reveal the entrance
Deep enumeration	Full UDP scans, large wordlists, vhosts, source reading — "don’t use the list defaults"
Hypothesis tracker	Full path list + basis + busted/rejected verdicts — Hard’s ship log
Decisive experiment	A test with "if I see this, it’s busted" decided in advance — leaves nothing ambiguous
Session-end record	Busted / remaining / tomorrow’s first move — the baton handed to tomorrow’s you
Enumeration regression	Repeating the same hypothesis signals a lack of new information → the rule of returning to enumeration
Link-isolation study	The countermeasure of detaching an unknown technique mid-chain and studying it separately

Today’s Commands

Command	What it does
`nmap -p- --min-rate 2000 target`	All TCP ports
`sudo nmap -sU --top-ports 100 target`	Top 100 UDP (in the background)
`gobuster dir -w raft-medium-directories.txt`	Large-wordlist directory scan
`ffuf -H "Host: FUZZ.domain" -w wordlist -fs size`	vhost fuzzing (size filtering essential)
`onesixtyone -c list target`	SNMP community string check

An Instinct More Important Than Commands

What Hard tests is not technique but the ability to operate amid stagnation — with a system that manages hypotheses in a table, chains sessions with records, and processes stagnation as enumeration regression, Hard changes from "a hard problem" into "a long problem." And the real completion condition of your first Hard is not root. It’s being able to answer the question "was the correct path on my hypothesis tracker?" — that is this week’s harvest, and that answer is the starting point of the next Hard. Walls don’t exist to be broken; they exist to show you the gaps in your system.

Once every box is checked, Step 273 is complete.