FireFlow Writeup - HackTheBox
Medium
Linux
Last updated July 13, 2026 • 4 min read
Discovery
Port Enumeration
A full TCP scan identified three exposed services.
┌──(kali㉿kali)-[~]
└─$ ports=$(nmap -p- --min-rate=1000 -T4 $TARGET_IP | grep ^[0-9] | cut -d '/' -f1 | tr '\n' ',' | sed 's/,$//')
┌──(kali㉿kali)-[~]
└─$ nmap -p$ports -sV -sC $TARGET_IP
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 80/tcp open http nginx 443/tcp open ssl/http nginx |_http-title: Did not follow redirect to https://fireflow.htb/ |_http-title: FireFlow — Task Force Nightfall | ssl-cert: | Subject Alternative Name: | DNS:fireflow.htb | DNS:*.fireflow.htb
The web server redirects to fireflow.htb, so the hostname is added locally.
┌──(kali㉿kali)-[~]
└─$ echo "$TARGET_IP fireflow.htb" | sudo tee -a /etc/hosts
The next move is to enumerate the web application.
Protected Writeup
This has not retired yet on HackTheBox. We only publish writeups for retired machines and challenges. Once it retires, this writeup will become publicly accessible.