Skip to content
HackIndex logo

HackIndex

Nexus Writeup - HackTheBox

Easy Linux
Discuss on Discord

Last updated June 25, 2026 • 5 min read

Joshua

HackIndex Creator

Discovery

Port Scan

┌──(kali㉿kali)-[~]
└─$ addhost $TARGET_IP nexus.htb
┌──(kali㉿kali)-[~]
└─$ scan_tcp_full nexus.htb 
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.16
80/tcp open  http    nginx 1.24.0 (Ubuntu)
|_http-title: Nexus Energy Authority — Powering the Nation's Future

Two ports. HTTP is the entry point.

Web Enumeration and Subdomain Discovery

The main site is a static corporate page for "Nexus Energy Authority." Reviewing the HTML source, a job listing modal exposes two email addresses:

<a href="mailto:careers@@nexus.htb">Apply at careers@@nexus.htb</a>
<a href="mailto:j.matthew@@nexus.htb">j.matthew@@nexus.htb</a>

Note j.matthew and careers as candidate usernames. Next, fuzz for virtual hosts:

┌──(kali㉿kali)-[~]
└─$ ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt \
-u http://nexus.htb \
-H "Host: FUZZ.nexus.htb" \
-fs 154 
git                     [Status: 200, Size: 14472]
billing                 [Status: 302, Size: 390]

Register both:

┌──(kali㉿kali)-[~]
└─$ addhost $TARGET_IP git.nexus.htb
┌──(kali㉿kali)-[~]
└─$ addhost $TARGET_IP billing.nexus.htb

git.nexus.htb serves a Gitea instance. billing.nexus.htb redirects to a CRM login page.

Protected Writeup

This has not retired yet on HackTheBox. We only publish writeups for retired machines and challenges. Once it retires, this writeup will become publicly accessible.