Hi Gajendra,

Currently, I am trying to solve at least one HTB machine daily and post writeup for the same.

After scanning for open ports there are a few things that come to my mind at a high level:

1. If it is a web service, I would proceed with visual inspection of the web pages, run a directory brute-force attack to find any hidden directories or look for vulnerabilities in the web service based on the version.

2. If it is not a web service, I start by trying to understand what the service is and what it does and then look for any exploits specific to the version that is running.

Hope that helps.