You want to find a vulnerability. So when your Nmap scan returns nothing, or your web fuzzer shows a 302 redirect to hackfail.htb , your brain whispers, "Interesting. Maybe this is a clue." Usually, it is not a clue. It is a typo. You forgot to add the target's IP to your /etc/hosts file.
10.10.10.250 hackfail.htb Now, when you visit http://hackfail.htb in your browser, the web server actually has a virtual host configuration for hackfail.htb (perhaps a default catch-all). The page changes. You start enumerating hackfail.htb —checking subdomains, looking for hidden directories. You are now completely off-target. hackfail.htb
#!/bin/bash # Pre-flight check for HTB TARGET_IP=$1 TARGET_DOMAIN=$2 echo "[*] Checking VPN connectivity..." ping -c 2 $TARGET_IP || echo "FAIL: Cannot ping target." You want to find a vulnerability