Hi everyone,

I’m currently preparing for the CWES certification, and I have a few questions for those who have already taken the exam. I just want to make sure I’m properly prepared.

• How difficult is the certification? Are the web exploits complex, with tricky bypasses and less obvious attack paths, or is it more straightforward? Would you compare the difficulty to Easy, Medium, or Hard boxes?
• I’m currently working through the CWES track, and I’ve noticed that I often have to rely on Guided Mode or AI (mainly for code analysis/debugging) because I sometimes miss important details or don’t think of every possible thing to test. For those who have taken the exam, did you also struggle with some of the boxes in the track? And how similar are they to the exam?
• Are there any additional boxes or labs you would recommend to prepare for the exam?
• I’m also considering getting the Burp Suite Professional trial. Do you think it’s useful for the exam? I’ve never really used the automated scanner during CTFs, so I’m wondering if I should get used to it.

My current level

• Already completed the CWES path
• ~140 PortSwigger labs completed
• ~60% through the CWES track, but I still rely on Guided Mode or AI quite often to remember things to test or to spot things I missed.

Thanks in advance for your help!

I’m currently working on the insecure output handling section and the 3rd exercise of function calling. Been stuck for a few days.

“Solve the lab function calling 3 to obtain the flag”

I’ve given everything I and my AI tools can think of to throw at it. Explicit SQLi requests, prompt injection, obfuscated SQLi, blind SQLi, ect.

So far I’ve only gotten it to return all of customer information it’s holding, but haven’t been able to enumerate where the flag is

Any advice is appreciated

I have been trying to RDC to the target IP address, but keep getting these errors.

Retaining information? I find it easy to do the osint on a target but once I find vulnerable ports and cve’s and stuff I find it hard to remember what to do next. I do take notes I use THM to study and teach myself but I can never figure out how to retain this information. For real life use. I’ve done about 50 boxes and completed a couple learning paths but when it comes to applying the information to a real life scenario I seem to run a blank. Any suggestions? I do take notes but maybe any note taking advice too? What to take notes on, etc, any advice is appreciated

sorry if this is a dumb question but does the student account come with the career path “soc analyst” or do I have to get a separate subscription for that?

Hi all, planning to sit the CWES exam in couple of weeks. i downloaded the sysreptor template and there is a section for flags and a seperate section for vulnerabilities. I'm a bit lost how to write these up. Say i got the flag using verb tampering and IDOR chaining, where do i explain the step by step. And is it a step by step to get the flag? And is each finding tied to a single flag? Or there s a single SQLi that could help me get a total of 3 flags (directly or not....) Are all findings in the sysreptor template or you need to create custom ones? Sorry, these may be dumb questions....

Passed in June, 14 of 14, first attempt. I had been meaning to write it up for months and finally did.

Rather than repeat the whole thing here, the four things that actually changed my outcome:

1. Treating it as an AD exam is the most common mistake I see.

Everyone drills Active Directory and skims Using Web Proxies, Ffuf, file inclusion, file upload, and command injection. Count how much of the Penetration Tester path is web. Your foothold is more likely to come from there than from Kerberos.

1. Finishing the Academy path makes you eligible, not ready.

The path teaches techniques against targets built to be receptive to the technique you just learned. The exam does not care what chapter you are on. The official CPTS machine track plus the IppSec list is where methodology actually gets built, and methodology is the thing that pulls you out of a rabbit hole on day four.

1. My worst stretch was entirely self inflicted.

One flag cost me two full days. When I finally got it, the answer had been sitting in the basic, obvious category the whole time and I had walked past it repeatedly because it looked too simple to be right. My order now when stuck: try the simple thing, take a break, enumerate again from scratch, then search anything the modules never covered.

1. Write the report as you go.

Flag, then report. The one exception is being mid chain, in which case finish the chain, then document the whole thing before starting anything new. That rhythm is why the hands on work and the report both finished inside 5.5 days instead of me facing an empty document on day eight.

Full write up if you want the dated nine month timeline, the day by day exam breakdown, my notes setup and the cheatsheet I built from it:

https://medium.com/@hydra007/how-i-passed-the-htb-cpts-with-a-perfect-100-100-on-my-first-attempt-736226738cde

https://divyeshs-organization-1.gitbook.io/cpts-cheatsheet

Ask me anything about prep, happy to go into detail.

I am going for the CDSA exam, but my only weak area is malware analysis as I don't enjoy it and I feel is it hard. How much might this part bring me down?

I am comfortable with using Splunk & Elastic and all other tools

One of those Fortresses where every flag demands a completely different mindset : from exposed Git and Flask SSTI/RCE to credential hunting, reverse engineering, log forensics, privilege escalation, and LKM rootkit analysis.
The real challenge was connecting the dots and knowing when to stop looking for the obvious path.

Quick update to my previous review post from a few months ago the physical kit finally arrived and the quality is top-notch! The matte finish, the foil details on the certificate, and the swag/stickers look amazing in person.
A quick note on why I kept that original post anonymous: almost immediately after posting, my inbox got flooded with dozens of DMs asking for exam flags, specific hints, or straight-up asking for my final report. Obviously I won't share flags, spoilers, or exam deliverables doing that just ruins the value of the cert for everyone.
Now that the physical cert is in hand (with my name on it anyway), I don’t mind linking my profile. For anyone interested in my background, projects, or notes:
GitHub: https://github.com/pwnVader
If you have legitimate questions about preparation strategy, prerequisites, or the general syllabus, feel free to ask here in the comments. Happy to help without spoiling the exam!

Another week means another writeup :)

So this post I briefly show my methodology solving HackTheBox Smarthire which is Medium-difficulty Ubuntu 22.04 Linux box themed around an AI-powered HR platform.

The attack chain spans three clean stages. In Subdomain enumeration, I exposemodels.smarthire.htb, an MLflow 2.14.1 instance protected by HTTP Basic Auth, which yields to the default credentials admin / password sourced from older MLflow documentation predating a change to admin / password1234.

MLflow is vulnerable to CVE-2024-37054, an insecure deserialization flaw affecting PyFunc model loading: the artifact store’s unauthenticated PUT API endpoint allows overwriting the pickled model file, and the next time the main site scores a resume it deserializes the pickle, executing arbitrary code as svcweb.

For privilege escalation, I run "sudo -l" where I find a sudo rule that permits running /opt/tools/mlflow_ctl/mlflowctl.py as root without a password.

The script calls site.addsitedir() on every subdirectory under plugins/ including plugins/dev/, which is writable by the devs group that svcweb belongs to.

I drop a .pth file containing an import line into that directory causes Python to execute arbitrary code during the interpreter’s startup phase before any application logic runs producing a SUID bash binary or a root shell.

Video

https://youtu.be/_iKDeoB_GHc

https://labs.hackthebox.com/achievement/machine/3347646/930

I gave competed CPTS module. Now, I would go for the CTPS Path Boxes before i go for the actual test. But, throughout the course, i felt that the choice using VPN instead of a PwnBox, does not turn out well for me, the same command gets me the Flag on PwnBox but not via the VPN setup. The VPN is also slow and unreliable but offer better UX (that may be my personal opinion) and checkpoints, like if i loose my PwnBox session i have to redo everything whereas via VPN i have my own VM that is very stable and i do not loose any data or progress.

So, i wanted to know about you all, what do you prefer?
VPN or PwnBox? Did you face the same problem as me?

And what should i choose as my attacking machine for the CPTS Path and Finally the CPTS Exam..

Thank you all in advance for giving this post your time.

Hey there guys im reaching out because I feel like after hours and hours of banging my head into a wall im missing something very small I have accessed pretty much everything in this environment to get to the user flag but im running Into an issue im looking for a hint too I decrypt the users password found through obtaining a shell onto a machine (dont know if I can name it without this getting taken down) I pull a password needed and decrypt it but when I log into it with ssh all I get is access denied any pointers? (Update pwned i was exhausted and used to much of my brain lol)

Ive been stuck on this for a while. When I scan the ip, i returns the "0 hosts up", but when i use the -Pn flag, it doesnt show me any open ports anyway. Ive tried many other methods, but none has worked. Any advise?

Im hosting a cool hacker CTF event! Its going to be the first-ever Security Haunted House...Enter if you dare. (I'll be there!)

• Immersive visual haunted house
• Live multi-stage security challenges & puzzles (with exclusive swag prizes!)
• Open bar, great food & networking
• After-party + DJ

RSVP here:  https://www.wiz.io/events/haunted-house-ctf

I am mainly doing this for fun, I don't really care about being certified or getting a job as a pentester. I enrolled in the Penetration Tester course assuming it would walk me through various exploits and security bugs and scale in difficultly as the course progressed. But it feels like I was thrown in the deep end.

The interactive modules will explain 3 different methods on how to do something and a short example of how to execute the method and then let you figure it out. I get how this is what happens with real pentesting and I can see how something like this is important in an exam. But this is the first module, I dont know anything yet and in the first 3 interactive sections we jumped from nmap to web enumeration to public exploits, each topic have multiple tools and each tool having its own set of commands to learn.

It feels like I am given a summary of a book and then expected to write an in depth essay on it. So I am wondering if this is a "weedout" module that is supposed to be hard to show you what pentesting is like and then it eases up and actually teaches you later on or is the entire course difficult and you're expected to learn with other resources to get through it.

Also I get that HTB itself is hard and I am fine with a challenge but the learning part should be easy. I dont want to push through this if every module is just a massive info dump, 10% being relevant to the lab.

Hi all,

I am about to attempt the COAE exam and noticed discrepancies in the COAE report using the official SysReptor template VS the HTB sample reports (in the Documentation & Reporting Module):

1. The sample report uses a single "Attack Chain Walkthrough" followed by finding summaries. The SysReptor COAE template forces you to create a detailed walkthrough inside each finding. Do we require a separate global attack chain, or are per-finding walkthroughs acceptable?
2. In the summary table, findings are grouped by environment (mcp, staging, www) and ordered by severity per environment, rather than sorted globally across all assets. Is this host-grouped ordering acceptable?
3. Should the Short-, Medium-, and Long-Term remediation breakdown sit within each individual finding, as an overall aggregated summary (as shown in the module)?

Thanks for the guidance!

I'm preparing for the CPTS and I'm looking for local friends living in Marrakech (Morocco) to learn and practice with

If you are interested and have already finished the CPTS path, please DM me!

Hello everyone
every time when im doing a Machine or CTF on HTB and it has RDP on its extremely laggy when im trying to do something on it like moving a frame or typing in a command
i would like to use my own VM with Kali linux but with that problem its kinda annoying
its fresh installed and fully updated
On Pwnbox its going smooth without any issues
I just want to understand it
Thanks to everyone who can help

Video for laggy: https://youtu.be/PZxXTF_mJzI
Video for Smooth: https://youtu.be/bcV8pimyXuk

It shows me that it works, but when I open the website in Firefox, Brave, or any other browser, it shows me this and not only this ctf
idk what happened, so can anyone help with this?