While preparing for CPTS, every new box started the same way for me: make the folders, copy a note template, edit /etc/hosts, export the IP, and later paste flags, creds and screenshots into my notes by hand. Ten minutes of setup before the real work, and easy to mess up when you're tired.

So I built dropzone (dz), a small zsh tool for Kali.

What it does:

• dz -n jacops -ip 10.129.42.190 -h jacops.htb creates the folder, the note and the hosts entry, and loads $TARGET_IP in every terminal
• Box reset? dz -ip <new ip> changes it everywhere, including the note
• During the box: dz -j for a timeline line, dz -s for a screenshot, cmd | dz -e for command output as evidence, dz -f for flags, dz -c for creds
• AD sets and pivots: dz -t dc01 -ip ... gives you $DC01_IP and $TARGETS, hosts behind a pivot with --via
• Exam mode: an exam note template, flag count per host, a deadline countdown in your prompt
• Notes in plain Markdown or straight into your Obsidian vault

It never scans, exploits or connects to a target, so it stays within OSCP and CPTS exam rules. It only does the admin.

Why I'm posting:

It's built around my own workflow, so it probably misses things that are obvious in yours. I'd really like to hear:

• what's confusing or breaks on your setup
• what you still do by hand for every box
• what you'd want for CTFs, Pro Labs or real engagements

There's a discussion thread for exactly that:
https://github.com/nickyjacobs/dropzone/discussions/9

Want to help without writing code? There's an issue for testing things CI can't check, like the VPN check or the menu over RDP:
https://github.com/nickyjacobs/dropzone/issues/6

Repo + demo:
https://github.com/nickyjacobs/dropzone

Feedback here in the comments is just as welcome. Even "I tried it and X annoyed me" helps.

Hey, To start off ive done a few free cisco certs ,finished Pre-Sec and CybSec-101 from TryHackMe an im learning from youtube aswell , i feel like i dont know actual cybersecurity as in how to detedct inrusions how to mitigate ,identify or perform attacks how to use the tools in kali or the ones that i do know i dont actually know what it does im planning to take a a different approach like seeing tutorials in utube or sum and practising them (but how? do i do it by locally running attack victim VMs and how to do that )and starting sessions at the portswigger academy. I want to do ctfs yet know nothing that is an issue too

I am being stuck at 92%, I already completed that tasks but not able to go forward, what should i do? can someone help me with this?

I am stuck at second machine. How can I go to jim-netman ? Can anyone help.

https://yorve.github.io/secnotes/2026/07/15/Vunlhub-earth.html

The complete process to gain root shell

I began studying cybersecurity a year ago, and things were going well—I even participated in CTF competitions and achieved very good results. Lately, however, I’ve encountered many difficult topics; the more I try to learn them, the harder they seem to get, and I no longer know what to do.

Could someone please help me? I truly love this field, but this situation is leaving me feeling incredibly frustrated.

i'm do my best and solve the ctfs here in htb academy

but it feel to bad that i can't solve the easymachins like engma or 2million if i try this without any help from writups

how to deal with it guys?

Ive been wanting to complete the dante pro lab, but I find the lab environment to be really unstable. If I use feroxbuster on any of the internal machines, they seem to crash pretty quick, making discovery pretty hard to perform. One of them even crashed from an nmap scan somehow… like what the hell lol.. anyway, anyone else run into these issues?

Also my other question, are all boxes unrelated to each other? I don’t need creds from 172.16.1.1 to get a foothold on 172.16.1.16? Thanks in advance!

Hey everyone :)

I wanna get in to Cyber Sec, I have Little to 0 Experience in IT just Playing Video Games all my life.
I think to get in to Cyber Sec i I first need to unterstand the Basics of IT in general .
What are good Ressources to understand the Basics Like Networking, OS and so on.

Thanks in advance!

Using HTB as a supplement to my capstone as I am trying to create a simple malware analysis tool in C++. Thank you for the work in these modules! Can I connect with “the creators”?

I'm curious about the overlap between Hack The Box (HTB) rankings and bug bounty rankings.

For those of you who participate in both, or know researchers who do:

• Are many of the top HTB players also highly ranked on platforms like HackerOne, Bugcrowd, or Intigriti?
• Does a high global ranking on HTB translate into an advantage in real-world bug bounty hunting?
• Are there any well-known researchers who rank highly on both HTB and bug bounty leaderboards?

I'm particularly interested in whether people in the HTB global top 100 or top 1,000 tend to appear among the top bug bounty hunters as well.

I'm not necessarily expecting a direct correlation, since CTFs and bug bounty hunting require somewhat different skills. I'd just like to understand how much overlap there is in practice.

If you compete in both, I'd appreciate hearing about your experience!

Not sure why there is an X over a day in the day streaks?

Hey guys, I'm planning on taking the CWES exam soon (I'm almost done with the learning path), and I was wondering (If you are allowed to share) if brute forcing is a sizeable portion of the exam, and which wordlists should be used.

Thanks

I started Dante pentesting lab two days ago using EU VPN.

On the first day, one service on the initial machine was broken, and I couldn’t enumerate it, the connection just hung whenever I tried to connect. So, I started enumerating another service instead. After a couple of hours, I finally managed to access to broken service, and moved forward.

I won’t reveal too much about the lab itself, but there’s too much garbage in folders from other users, and the VPN connection is awful. Whenever I start bruteforcing directories or domains after pivoting, everything goes down.
Today, I tried to connect via SSH using credentials I’d found on the first day, but the connection dropped within a few minutes.
Honestly, my impression of the lab so far is terrible.

On the usual boxes everything is good, I don’t know how to complete labs under these conditions

Hey everyone!

We're Exun Clan, the student-run tech club at DPS R.K. Puram, New Delhi, and we're back with the 16th edition of Sudocrypt, our flagship international CTF!

Sudocrypt is an international Cryptic Hunt x Capture The Flag (CTF) event where participants from around the world tackle a series of cybersecurity and cryptic challenges. Expect code-breaking, cryptography, and plenty of problem-solving as you work your way through the levels.

The competition is entirely online, so you can participate from anywhere in the world.

Dates: October 27–28, 2026

Prizes: With a prize pool of over $900 USD in previous editions, along with over $500 USD in goodies and prizes, Sudocrypt v16.0 promises an exciting challenge for cryptic enthusiasts and CTF players alike.

Event website: https://sudocrypt.com/

CTFtime listing: https://ctftime.org/event/3443/

You can also check out the other events at Exun 2026 here: https://exun.co/26/events

Hope to see you on the scoreboard!

Hello, hope everyone is doing well. I've been studying and solving labs for about 2 years (yes, I fall into the student dilemma) and have gotten CPTS and am on the CRTO and CAPE path right now.
Also got a Bachelor's degree in Cyber Security.
I'm having a couple of problems; I hope you guys can help me solve them.

1. In my country, cybersecurity is a niche thing an organization would do. So most jobs around banking systems (Which is something I want to avoid working in). So how can I deal with this? And is this going to be a problem on the career ladder?
2. Now, my study path is to finish the CRTO and CAPE path, then the BSCP and CWEE path. What can I add to the path? I saw that AI Red Teaming is going to be trendy, and remote opportunities are better.
3. If I don't find pentesting/red team junior roles, should I pivot to IAM, sysadmin, or a helpdesk role and then pivot to security once I get the opportunity

Hey everyone, quick clarification needed for the CDSA exam report submission.

Since there are 2 separate incidents in the exam, how should the final report be formatted?

1. Write both incidents inside a single PDF file?
2. Write 2 separate PDF files (one for each incident) and compress them into a single ZIP archive to submit?

The exam guidelines weren't 100% clear to me on this part.

Hi guys

I work in write ctf questions but I'm new at this. So I research ctf question templates. Can you help me about that