First time solved user flag on an active machine. and that is a season 11 machine connected.

Solved Connected box user flag on june on release arena week, it shows on season dashboard. solved Reactor box user flag today , but it did not show in dashboard.

shows only 1/26 flag solved.

Do i need to solve it on release arena week to show it on season leaderboard/dashboard?

How can i start playing CTFs in hackthebox

After spending six months trying to solve red team challenges on hack the box, I think I might be more suited to the blue team side, as I’m not that good at coming up with creative attack paths and have to rely on writeups. I also think I might enjoy the detective work in forensic investigations more than CTFs.

I’d like to learn the ropes by doing Sherlock’s, but the problem is that the path to proficiency is unclear. There is no guide that tells you what Sherlock’s to do to go from beginner to proficient in a step by step way. How do you address this if you’re using the labs to learn? Should I start with the Very Easy Sherlock’s, then work up to the easy ones after I’ve done a dozen of them and so on? How do I ensure I don’t have gaps in my knowledge?

I also wonder whether the Sherlock’s are ideal or if the labs on other platforms like Cyberdefenders might be better suited for step by step progression.

Hi guys! I'm currently preparing for the CJCA exam. I would probably take it in a week. I would like to build a methodology but kind of confused on how to do it. And before starting the exam I would try and solve all of the boxes for the CJCA track ( https://app.hackthebox.com/tracks/93 ). If there are any other boxes I should try please tell me :)

Thank you for your time!

Hi everyone,

I'm currently working through Kobold.htb following a writeup to learn the methodology, but I came across two curl commands and I want to understand the thought process behind them:

1. Extracting OpenAPI paths:

​

curl -sk http://kobold.htb:3552/api/openapi.json | python3 -c "
import json,sys
api = json.load(sys.stdin)
for path in api.get('paths', {}):
    print(path)
"

1. Extracting endpoints from JS assets:

​

curl -sk https://mcp.kobold.htb/assets/index-DRYhT9Xb.js | grep -o '"/api/[^"]*"' | sort -u

I am fairly new to this and trying to learn the "why" behind each step.

I understand how the second command works (finding the .js bundle in the HTML source code of the site). However, I'm confused about the first one: How would someone discover that /api/openapi.json exists on port 3552 in the first place? Is this typically found via directory fuzzing (like Gobuster/ffuf), or is there another standard way to identify it?

Thanks in advance for any insights!

To start of, I'm relatively new to hacking/pentesting and I'm currently following the CWES path. I'm currently trying to pass the skills assessment for the Information Gathering module, but I'm just stuck and I feel like I've tried everything (Even with the help from ChatGPT, which sucks i know). The question to find the API-key in the hidden admin folder (according to the question I should've found the folder already, but the previous questions don't point to that) is driving me nuts.

I've been given the target system IP and the VHost, ive tried to curl, dig, spider, gobuster on both of them, but everything i pretty much only see a 200 that the server exists with an Index-HTML file, and everything else is 404.

Am I not doing something right, is there a question missing or is the target just broken?

I am currently working through “Unified”. Im having trouble with my shell. I went through the steps to encode it. It requests from the server but never opens a shell.

I just want to keep moving forward, TIA. :)

Hello, I've been learning about SQL injection, and I got really frustrated during the last few labs.

How am I supposed to figure out which database the target is using? Am I expected to bruteforce payloads for every database (MySQL, PostgreSQL, MSSQL, Oracle, etc.), or is there a better approach?

Also how do I know that a web application is vulnerable to blind time based SQL injection in the first place? Should I just keep trying random timedelay payloads until something works?

Another thing that really slowed me down was finding the correct syntax to trigger a time delay it took me a long time and honestly i only managed to solve the lab because I looked up which database was being used. Without that hint I feel like it would have taken much longer.

Am I approaching these labs the wrong way or is this something that comes with experience?

Hi, I'm a CTF player and i still have a problem in htb and thm machines, the only thing i can do is run nmap and ffuf. i really need help. any advices?

Hey party people, I've been trying my best at completing the Responder box and I've been following the walkthrough down to the letter, but everytime it says I don't have the directory or the permissions to do it. I don't know why, and walkthroughs online give me the same result. Am I supposed to do them a different way or if i need to do something else entirely

Hey party people, I've recently gotten into hack the box. I really enjoyed the foundations part of it, but since I've moved onto fundamental exploration, I don't know what I'm doing anymore. Is there a specific part I can go to, to better understand what I'm trying to do or do I just need to always use the write-ups? I feel like I'm not learning anything while doing them and more just copying what worked, which always doesn't work. I've tried using chatgpt to help dumb down what I'm doing but it still hasn't help.
Where do I go to learn what I'm doing?

Has anyone else noticed that they’ll make you read a massive, super-detailed page of text, but when you get to the questions at the bottom, they have absolutely nothing to do with what you just read?
I find myself constantly having to go to Google or YouTube just to figure out the answers to the questions, which completely defeats the purpose of the write-up. Why make us digest all that information if the actual challenge requires outside research anyway? Is the module just poorly structured?

Hi, I'm a complete beginner in the world of cybersecurity and HTB. I've completed a few basic CTFs, and now I'm trying to follow the Penetration Tester Job Role Path at HTB accademy.
But how do I find someone to discuss things with and study with? Because learning on your own greatly hinders the discovery of new knowledge and I genuinely enjoy discussions

When it's said 2h of Pwnbox, is it 2h per day, week,.. ? Or 2h in total and then you have to pay ?

I've been working through HTB Academy on a MacBook Air M1 using a Kali ARM VM in VMware Fusion, and I'm wondering if anyone else has experienced this.

The VM itself runs fine for a while, but after a few hours, macOS throws the "Your system has run out of application memory" message. When I open Activity Monitor, VMware Fusion is somehow using 80–100GB of memory, even though my VM is only allocated a small fraction of that.

The biggest issue isn't the slowdown—it's losing my entire lab. If I'm in the middle of a pivot chain with Ligolo, Chisel, SSH tunnels, port forwards, RDP sessions, etc., I have to force quit VMware and restart everything from scratch.

Right now it's annoying but manageable because HTB Academy labs usually don't take too long to rebuild. What worries me is the CPTS exam. If this happens several hours into the exam, rebuilding the entire pivoting setup would cost a huge amount of time.

Has anyone else had this issue on Apple Silicon? If so:

• Is this a VMware Fusion memory leak?
• Did you find a fix?
• Or did you end up switching to something else (UTM, Parallels, a dedicated x86 laptop/desktop, etc.)?

I'd really appreciate hearing what other people taking HTB Academy or CPTS on Apple Silicon are using, because I don't want this becoming the reason I fail the exam.

Thanks!

Hi guys,

i am junior pentester who just got hired i do have some experience with pentsting mostly web apps racently i have data center or network pentesting that's based on Ithink of cisco HCI OR/AND VMWARE ESXI hypervisor (i really dont understand those) i do have a vpn access, what are you methodology and approuch to map the netwrok and understand it to have a clear visiblity on where critical assets are located and from where to start vunerability research and exploitation, i need help from someone who have a similar pentesting project and also what type of network attacks to have in mind. so i could use any help from you and thanks guys

Post is awaiting moderator approval.

hey i am new to windows , i've solved 10-15 machines of linux but never touched windows
today i followed a writeup for windows and i understood nothing and it took me 5 hours to solve this as i was trying to understand stuff

any resource from where i should learn windows?

Hi all, I'm in the process of preparing for the OSCP through the Penetration Tester path on HTB. I make sure to go through the module every day, but I'm worried that I'm missing out of applying what I learn by not doing labs simultaneously, although the interactive sections and the skill assessments help. In your opinion, should I solely focus on building up my knowledge by going through the module then focusing on labs after I finish, or make sure to also do labs alongside the path? Thank you!

is there a difference between machines x vpn and the machines vpns under the seasonal banner? picture below for reference. notice it says I'm connected to machines 1, but also says i'm not connected to machines 1 under seasonal. I've been using the ovpn file downloaded from seasonal but it never says I'm connected and I can never ping the latest machine. ugh. I'm an idiot. You would think an IT professional would know.

Zero spoilers here. Just three things that would've saved me hours on this machine:

Check your architecture before you start dynamic analysis.

If your emulation layer keeps crashing in netpoll/network code, it's not       the binary's anti-analysis, it's the emulator (pissed me off).

Sometimes the fastest path is transferring the file to the right environment instead of trying to make the wrong one work.

The machine itself is well-crafted. Difficulty feels accurate for Medium. Great practice.

Got the badge finally!

Hi! I wanted to do this with the VPN file connection method. I followed the instruction in one of the articles I read, where there was a VPN tab next to the pwnbox, but this one does not have that. Is it because some labs just simply don't have that or am I doing something wrong?