They Count on You Not Knowing: A Beginner's Map of How Hacking Actually Works

Series: The Community's Red Team

Post: 01 of 16

Tags: methodology, red team, beginner, recon, exploitation

Read time: ~10 min

Most people picture hacking as some genius sitting in a dark room typing impossibly fast while green text scrolls down the screen hacking into some black box of unknown technology. The reality is closer to a plumber reading blueprints before opening a wall. You follow a process. You work through a checklist. And the reason it works (almost every time) is that the people who built the system were counting on you not knowing what to look for.

This post is the map. Not a deep dive into any single tool, but the full picture of how a penetration test actually moves from zero knowledge to full access. Every post in this series will zoom into one piece of this map and teach you to use it. By the end of the series you'll have the same mental model a working red teamer uses on every engagement.

Let's start from the beginning.

The Core Loop

Every engagement — whether it's a CTF box, a lab environment, or an authorized real-world pentest — follows the same fundamental loop:

Scan → Enumerate → Exploit → Escalate → Pivot → Loot → Repeat

That's it. Everything else is just filling in the details of each step. The loop repeats because getting into one system usually gives you credentials, keys, or network access that opens the next one. A good red teamer is always asking: what does this finding unlock?

Step 1 — Scanning: Learn What's There

Before you can attack anything you need to know what's running. A target machine is a black box until you scan it. Your scanner knocks on every door and listens for an answer.

The tool for this is Nmap (next post in this series). You're looking for:

• Open ports — every open port is a potential entry point

• Service names — what software is listening on each port

• Version numbers — old versions have known vulnerabilities

• Operating system — Windows and Linux have completely different attack surfaces

A basic scan gives you something like this:

22/tcp  open  ssh     OpenSSH 8.2
80/tcp  open  http    Apache httpd 2.4.41
445/tcp open  smb     Samba 4.11.6

Three open doors. Each one leads somewhere different.

Don't skip UDP. TCP scanning is the default but some critical services — SNMP on port 161, DNS on port 53 — only speak UDP. Missing them means missing attack surface.

What you're building: a port map. Every open port gets assigned to a scenario, and that scenario has a checklist.

Step 2 — Enumeration: Learn What It Has

Scanning tells you a door is open. Enumeration tells you what's behind it.

Each service has its own enumeration tools and its own version of the question "what can I find out without credentials?" The answer is often more than the system owners intended.

Web (ports 80, 443, 8080): Tools like Gobuster and Nikto find hidden directories, login pages, admin panels, backup files, and configuration files left exposed. A /backup.zip or /admin/config.php showing up in a directory scan has ended many engagements early.

SMB (ports 139, 445): File shares on Windows and Linux servers. Enum4linux and CrackMapExec can list shares, enumerate users, and sometimes read files — all without a username or password. Developers leave credentials in shared folders more often than anyone wants to admit.

LDAP (ports 389, 636): Active Directory speaks LDAP. An anonymous bind to an LDAP server can dump usernames, group memberships, and sometimes password hints. This is pure gold during an Active Directory engagement.

SNMP (port 161/UDP): Network management protocol. Old equipment and misconfigured servers will hand you running processes, installed software, and network interface details if you ask with the right community string. The default community string is literally public.

The golden rule of enumeration: every username, hostname, version number, and file you find is ammunition. Track everything. A username found in an SMB share might be the login for the web app. A hostname pulled from an SSL certificate might resolve to a completely different server you didn't know existed.

Step 3 — Initial Access: Get a Foothold

You've mapped the surface. Now you find the crack.

Initial access usually comes from one of three places:

Weak or default credentials. This is the most common way in, and it's embarrassing how often it works. Admin panels, SSH logins, database interfaces, and network devices running on default passwords like admin:admin or root:root. Tools like Hydra and Medusa automate credential brute forcing against almost any service.

Unpatched vulnerabilities. That version number you grabbed during enumeration? Search it. Apache 2.4.41 has known CVEs. Samba 4.11.6 has exploits in Metasploit. Security through obscurity and delayed patching is how corporate networks get owned.

Web application vulnerabilities. If there's a web app, there's a potential for SQL injection, file upload bypasses, local file inclusion, or insecure direct object references. Web apps are consistently the most common entry point in real engagements because they're complex, they're written by developers under deadline pressure, and they face the open internet.

When you get in, you'll likely have a limited shell — maybe a web shell, maybe a restricted user account. That's your foothold. It's not the goal. It's the beginning.

Step 4 — Privilege Escalation: Own the Machine

A foothold gives you access as a low-privilege user. Privilege escalation gets you root (Linux) or SYSTEM/Administrator (Windows). Full control of the machine.

On Linux, you're looking for: SUID binaries (programs that run as root regardless of who executes them), sudo misconfigurations (can this user run something dangerous as root?), cron jobs running as root that execute writable scripts, and kernel exploits when nothing else works. LinPEAS automates finding most of these in seconds.

On Windows, the surface is different: unquoted service paths, weak service permissions, token impersonation, DLL hijacking, and stored credentials in the registry or config files. WinPEAS covers the automated sweep.

The key mindset shift for privesc: you're not looking for complexity. You're looking for mistakes. Someone configured a cron job to run a script in /tmp. Someone gave a service account write access to its own binary. These are human errors, and they're everywhere.

Step 5 — Credential Hunting: The Keys to Everything Else

Once you own a machine, you mine it. This is called pillaging, and it's where single-machine access becomes network-wide access.

What you're looking for:

• Config files — database credentials, API keys, connection strings

• Shell history — .bash_history and PowerShell history are full of passwords typed in plaintext

• SSH keys — a private key in ~/.ssh/ might unlock 20 other servers

• Browser saved passwords — on workstations, browsers store credentials for internal apps

• Memory — on Windows, Mimikatz can pull plaintext passwords and NTLM hashes directly from RAM

Every credential you find gets tested against every other service you know about. Password reuse is the norm, not the exception. The database password in a web app config file is often the same as the admin's domain account password.

Step 6 — Lateral Movement: Cross the Network

You own one machine. The real targets are usually elsewhere — a domain controller, a database server, a file server with sensitive data.

Lateral movement is how you get from your foothold to those targets using what you've collected. The core techniques:

Pass-the-Hash: Windows stores password hashes in memory. You don't always need to crack them. You can authenticate to other Windows machines directly with the hash using CrackMapExec or Impacket's tools.

Pass-the-Ticket: Kerberos tickets (the authentication tokens Active Directory uses) can be stolen and reused. A domain admin's ticket in memory is a domain admin's ticket in your hands.

SSH key hopping: That private key you found? Try it on every other host in the environment. If it works on one server, there's a good chance it was deployed across many.

WMI and PSExec: With valid credentials, Windows Management Instrumentation and PSExec let you run commands on remote machines as if you were sitting at them. These are the same tools IT admins use for remote management — which is exactly why they work so well for lateral movement.

Step 7 — Pivoting: Reach What You Can't See

Internal networks are segmented. Your foothold might be in a DMZ. The real targets are in the internal network your machine can reach but your attack box cannot.

Pivoting routes your traffic through the compromised machine to reach those internal segments. Tools like Chisel and Ligolo-ng build tunnels that make internal hosts appear directly accessible from your machine. You set up the tunnel, adjust your routing table, and suddenly you can scan and attack the internal network as if you were physically inside it.

This is where engagements get interesting. A compromised web server in the DMZ becomes a launchpad into the internal network. A compromised internal workstation opens the path to servers that are never supposed to face the outside world.

The Full Picture

Put it together and you get this chain:

Nmap scan          → find open ports and services
Gobuster / Nikto   → find hidden web content
Enum4linux / CME   → enumerate SMB and credentials
Hydra              → brute force weak credentials
Exploit / Metasploit → gain initial access
LinPEAS / WinPEAS  → find privesc vectors
Mimikatz           → harvest credentials from memory
CrackMapExec       → move laterally with harvested creds
Chisel / Ligolo-ng → pivot into segmented networks
Bloodhound         → map Active Directory attack paths

Each tool in this series has a specific job in that chain. Understanding where it fits is more important than memorizing its flags.

Why This Matters Beyond CTFs

This methodology isn't just for labs and competitions. It's the same process used on real authorized engagements against real companies. The reason it works is systemic: organizations build complex systems, complex systems have misconfigurations, and misconfigurations compound. A weak SMB share leads to a credential. A credential leads to a server. A server leads to a domain controller. The chain is always there if you know how to follow it.

That's the whole point of training the community's red team. Not to create attackers — to create people who understand the attack so thoroughly that defending against it becomes second nature.

The exploit only works on the uninformed.

What's Next

The next post dives into Nmap — the first tool you'll run on any target, and the one that sets up everything that comes after it. We'll cover the full flag set, the workflow that saves you time, NSE scripts for specific services, and how to read the output to build your attack plan.

Series roadmap:

#	Post	Tool / Topic
01	✅ This post	Red Team Methodology Overview
02	Next	Nmap — Port Scanning & Service Enumeration
03		Gobuster — Directory & DNS Brute Forcing
04		Nikto — Web Server Vulnerability Scanning
05		Enum4linux — SMB & Samba Enumeration
06		CrackMapExec — The Swiss Army Knife
07		Hydra — Online Credential Brute Forcing
08		Medusa — Parallel Network Login Attacks
09		Hashcat — Offline Hash Cracking
10		John the Ripper — Keys, Zips, and Hashes
11		Netcat — The Hacker's Multi-tool
12		Metasploit — Exploitation Framework
13		LinPEAS / WinPEAS — Automated Privesc Recon
14		Impacket — Windows Protocol Swiss Army Knife
15		Chisel — TCP Tunneling Over HTTP
16		Ligolo-ng — Clean Pivoting at Scale
17		Bloodhound — Mapping Active Directory

MeshForge — Training the Community's Red Team

They count on your ignorance. The exploit only works on the uninformed.