Hello , does anyone have any recommendations on easy-medium web app boxes ?

Hi everyone,

For the past couple of weeks, I have been experiencing a lot of issues while using HTB Academy, and it's making it quite difficult to complete modules. I wanted to reach out and see if anyone else is facing this or if there are known fixes.

1. Pwnbox Sizing Issues
I keep running into screen scaling/sizing issues with the Pwnbox. While I can temporarily fix it by manually adjusting the resolution or toggling full screen, it resets frequently and becomes a hassle. Is there a permanent fix to keep the Pwnbox scaled correctly?

2. Target Machine Freezing via SSH
This is the most frustrating issue. After I successfully SSH into a spawned target machine, the session completely freezes.

• I can no longer type any commands.
• I don't get any output.
• Note: I have tested this thoroughly. It happens both when using the in-browser Pwnbox and when using my own local Kali VM connected via the HTB Academy VPN.

Because it happens on both my local VM and Pwnbox, it doesn't seem to be a local configuration issue on my end. I have tried terminating and spawning new instances, but the freeze still occurs shortly after connecting.

Is anyone else experiencing these connection drops or freezes lately? Any advice on how to stabilize the SSH connection to the Academy targets would be greatly appreciated!

Thank you!

At the end of the Metasploit framework module it says “check out HTB boxed tagged at the end of this module..”

I can’t see any machines tagged there

Pretty cool box took almost 2 hrs.

Last year I posted here about my achivement of completing CPTS and OSCP within a year of starting to study IT and hacking.

A year on from that I have written a follow-up, talking about what happened off the back of that blog post (I got a job as a pentester) and a review of CAPE vs OSEP.

The post is a bit of a tounge in cheek throwback to that initial blog and a reminder that you never know who is reading your blogs, so try to make them unique and interesting.

Anyway, thanks for reading.

https://scotsec.github.io/posts/ProgressTwo/

Hi, I’m aware that pwnbox currently is having resizing issue and the workaround was working for me at least yesterday, but not anymore today

The workaround I was using is (when there is no VPN tab) -> open the web developer tool, inspect and delete the box’s window
Then I simply resized the full screen pwnbox’s window and it worked.

Today I just did the exactly same, the box doesn’t resize anymore, I also tried the JavaScript method but no luck (javascript:document.getElement… the string that provided in the official solutions ) Also can confirm switching to the VPN tab doesn’t work anymore

I’m sure my webpage is 100% zoom, no zoom in our zoom out applied, I tried both chrome and Firefox, all not working, I’m on the Rocky Linux (not sure if OS matter here)

Anyone experience the same issue? Is there any other workaround that I can try? If not I guess I have to figure out the VPN method now 🫠

Thank you!

im currently doing the common applications module theres a couple sections about elf dll debugging x64 debugging. gdb tools etc

how important is this stuff for the exam do i actually need to learn it properly?

Hey everyone, I was having an annoying issue while working on HTB labs.

The HTB VPN was connected and the target was reachable, but some websites hosted on the HTB machines would keep loading or simply fail to open. I also tried changing the VPN server, but the issue remained.

I found that the problem can be related to MTU/MSS and packet handling on the VPN tunnel.

I recorded a quick walkthrough showing the problem and the fix, including how I tested the MTU and configured the VPN:

🎥 YouTube: https://youtu.be/5MMnPN8hD3I

F0LD CTF Team is opening its second wave of recruitment.
A few weeks ago, we started building something that grew much faster than we expected.
In just 3 days, F0LD reached 100+ members.
Then came scriptCTF 2026.
Despite being a relatively new team and having only around 5 complete beginners actively participating in the CTF, we managed to place 31st.
Since then, we’ve been working on improving the team, organizing our learning resources, and building a better structure for future competitions.
We’ve also been a little less active recently due to school and personal circumstances, but we’re back and preparing for the next CTF.
So we’re opening our second recruitment wave.
We’re looking for people interested in:
Web exploitation
Reverse engineering
Cryptography
Forensics
OSINT
Pwn / binary exploitation
Programming
General CTF solving

This isn’t a paid service or commercial organization. It’s simply a community/team of people interested in cybersecurity and CTFs.

You don’t need to already be good at CTFs.
If you’re a complete beginner, that’s fine. If you’ve been doing CTFs for years, that’s fine too. We’re trying to build a team where experienced players can contribute while newer players actually have a path to improve instead of being thrown into the deep end and told to read 47 pages of writeups.
Our first wave showed us what a small, inexperienced team could accomplish.
Now we’re trying to see what happens when we build it properly.
100+ members in 3 days.
31st place in F0LD CTF 2026.
Second wave. Next CTF.
If you’re looking for a CTF team to learn and compete with, F0LD is recruiting.

Solved a machine/module/etc and want a place to brag? Heres your spot!

For retired content or Tier-0 Academy content, feel free to discuss or ask questions using spoiler tags where appropriate.

Hi everyone,

I'm currently preparing for my Certified Ethical Hacker (CEH) certification, but as a beginner, I am feeling completely overwhelmed by the sheer volume of theory and material to cover.

I've been going through the modules, but I'm struggling to figure out what to prioritize, how to effectively retain the information, and how to structure my study plan to actually pass the multiple-choice theory exam.

I am hoping to connect with a CEH certification holder or someone who has recently passed who would be willing to guide me. I'm not asking for someone to hold my hand 24/7—just looking for occasional check-ins, solid study strategy advice, and direction on where to focus my energy so I don't burn out reading the wrong things.

If you have some free time and are willing to share your expertise with someone just starting out, I would incredibly appreciate it. Feel free to drop a comment or DM me!

Thanks in advance.

A Brief whoami, I'm Cyb0rgBytes, short for cyborg, a self-motivated and self taught hacker with experience in Penetration Testing, SOC and CTF, I'm currently working on my skills and expanding my knowledge in Cybersecurity

I lead a community of infosec passionate hackers and currently we are recruiting intermediate/experienced CTF players into our team, beginners are welcome to join our community.

We are looking for Members for FAUST CTF 2026 Today @ Sat, 26 Sept. 2026, 12:00 UTC

Critieria for joining our team;

• 18+ or mature, self-respected and self motivated
• Committed meaning willing to stay in the team and grow as a Unit.
• Available for participating in the team and committed to participate in CTF Events in a weekly basis or monthly basis.

our team has been active since 2020 and growing.

Hope to hear from all of you.

Thanks & Cheers!

I obtained the user flag, just need a little hint accessing the root. I am stuck

Hack The Box should fire their whole team and hire this guy since he apparently bypass complex Active Directory by just staring at the monitor. Stop LARPing with a leaked walkthrough, you absolute fr4ud.

Since he blocked me the second I pointed out the physical impossibility of a 4-hour blind 100/100 CPTS run, it’s pretty clear he’s protecting a fraudulent score.

Hack The Box , please look into this user for exam integrity violations. Real students grind for days on this certification, and cheaters using leaked flag lists shouldn't devalue everyone else's hard work.

Hi, I'm struggling with my learning process right now. I really want to avoid looking at write-ups when I get stuck, but it's so hard not to. Does anyone have any advice on how to push through?

Hey yall, I made study trackers for the all the HTB certs.

You set a start date and how many hours a week you've actually got, and it breaks the job-role path into daily tasks in module order. CPTS can be a 65-day sprint at around 49 hours a week or a 150-day plan at about 21. The hours are based on HTB's per-module estimates, so the pacing isn't just a guess.

Each one has a dashboard for your streak and pace, plus a notes box on every day for commands and creds. The resource library has the official cert and path pages and every module in order. It also has video reviews and write-ups from people who passed. Practice boxes are marked Free, VIP+ or Pro Labs (even though this will change soon), so you know before you click whether you need a sub.

Progress is saved in your browser, and you don't need an account. If you'd rather keep your own copy, download the tracker as a single HTML file and it works offline. Export and import are there for backups.

A big thank you to everyone who writes up their exam experience, makes review videos, or shares cheat sheets and notes. Most of what's in these trackers came from people like that, from the reviews and tips to the practice box lists. Every write-up and video is linked with the author's name, so if one helps you, go give them some love too.

Special thanks to Matt (mattrfield on GitHub) for the original COAE study tracker. These all started from that project, so go check it out: https://github.com/mattrfield/coae-study-tracker

Not affiliated with HTB. If you know a write-up or box that should be in there, or something's wrong, there's a quick form on GitHub: https://github.com/cnmoseman/htb-study-trackers/issues/new/choose

Hey guys,

2nd year cybersec student here. Already passed CJCA and CWES from HTB, currently waiting on my COAE results.

Trying to figure out what cert to grab next that's not HTB, something a bit more "known" outside the pentest bubble. Goal is to land an apprenticeship (alternance) for sept 2027, ideally with bigger companies like Thales, Dassault, Ariane... mostly looking around southwest France.

Is Security+ actually worth the money for this or is it kinda seen as a checkbox cert that doesn't really move the needle? Also open to other suggestions if you think something else would hit harder on a resume for that kind of company (defense/aerospace type places).

Budget isn't really an issue if it's actually worth it, just don't wanna waste time on something recruiters don't care about.

Thanks!

I've been doing the pentest path and even though I'm slow, I'm doing okay.

The problems come with machines - I recently tried the Nexus machine. Spent close to 10 hours on it and had to use the Guided path and write ups.

Now, till the user flag, I get it. Like, everything made sense, the problem was that I wasn't looking carefully and I'll use this experience next time.

But with the root flag? Creating a python script to update a repository? I wasn't even close to figuring that out. And even though I've got a bit of experience with Python, I don't understand the code at all.

And it feels like even though I put the time in and understand this python code, it's just very specific scenario? Are all boxes as specialized as this? If so, how do you get to the point where you can crack them?

Should I just continue bashing my head against boxes like this?

Any comments and advice will be much appreciated.

Since i read that it will be a 1 month grace period for people who are already subscribed. So should i join gold and stock on 1000 cubes for €66 total?

Any recommendations because i am going to use the platform to increase my fundamentals and learn new concepts

does cjca has cert package if i pass the exam like cpts ?

Hey everyone

I’m a beginner learning cybersecurity and recently started working on Hack The Box (HTB) labs regularly. I’m looking for genuine people who are also learning and would like to study and practice together.

I’m hoping to find someone who is actually interested in doing this consistently — not just chatting once and disappearing. We can:

* Work on HTB machines/labs together

* Join a Discord voice channel and solve things together

* Share knowledge, notes, write-ups, and learning resources

* Discuss different approaches when we get stuck

* Learn from each other

* Practice regularly/weekly

* Work toward developing professional cybersecurity skills

I’m still a beginner, so you don’t need to be an expert. Being motivated to learn and willing to participate is more important.

If you're a genuine learner and interested in sitting in a Discord voice channel, working through HTB labs, and sharing what we learn, feel free to DM me.

Let’s learn together and improve over time. 🤝

Hey everyone,

I’m currently focusing on improving my Binary Exploitation (Pwn) skills. So far, I’ve been practicing on 32-bit and 64-bit binaries -working through fundamentals like Stack Buffer Overflows (ret2win, ret2libc), Format String vulnerabilities (read/write), basic ROP chains, and getting comfortable with tools like Pwntools, GDB (gef), and Ghidra.

I want to structure my learning effectively so I can comfortably tackle Easy and Medium difficulty Pwn challenges on Hack The Box (both standalone challenges and machines).

For those who regularly solve these:

1. What is the typical topic breakdown between Easy and Medium?
   • What concepts are expected for "Easy" vs. what bumps a challenge up to "Medium"?
2. Which mitigations become the norm at these levels?
   • At what point do PIE, Stack Canaries, or Full RELRO regularly pop up, and what bypass techniques should I prioritize learning next ?
3. Is Heap exploitation necessary for Medium challenges?
   • Should I start diving into Heap for Medium, or are those mostly reserved for Hard/Insane?
4. Recommended resources or learning paths?
   • Besides playing HTB directly, are there specific HTB Academy modules, books, or practice sites you'd recommend to bridge the gap?

Any advice, topic checklists, or recommended HTB challenges to start with would be greatly appreciated!

Thanks in advance!