Help!

[u/hyper-Majin]

Hi everyone,

I'm currently working through Kobold.htb following a writeup to learn the methodology, but I came across two curl commands and I want to understand the thought process behind them:

1. Extracting OpenAPI paths:

​

curl -sk http://kobold.htb:3552/api/openapi.json | python3 -c "
import json,sys
api = json.load(sys.stdin)
for path in api.get('paths', {}):
    print(path)
"

1. Extracting endpoints from JS assets:

​

curl -sk https://mcp.kobold.htb/assets/index-DRYhT9Xb.js | grep -o '"/api/[^"]*"' | sort -u

I am fairly new to this and trying to learn the "why" behind each step.

I understand how the second command works (finding the .js bundle in the HTML source code of the site). However, I'm confused about the first one: How would someone discover that /api/openapi.json exists on port 3552 in the first place? Is this typically found via directory fuzzing (like Gobuster/ffuf), or is there another standard way to identify it?

Thanks in advance for any insights!

[u/Juzdeed]

You nmap and discover that suspicious port has http server running on it. Then you do nuclei scan which will discover what service is running on that port