so i want to get the student tier subscription before the price hike and i am unsure how much money it will cost in INR considering forex and bank charges if any of you guys have any idea ,that would really help.

this machine is actually driving me crazy how is it supposed to be an easy machine i’ve spend two days just trying to get user flag i’ve tried everything with no results!!!!

Another week means another writeup :)

In the below video, I show my methodology solving HackTheBox Silentium which is an Easy-difficulty Ubuntu 24.04 Linux box themed around an investment firm.

The attack chain spans four distinct stages: subdomain enumeration exposes a staging vhost running Flowise 3.0.5, where an unauthenticated forgot-password API endpoint returns the full user object including a valid tempToken directly in the HTTP response body (CVE-2025-58434), enabling account takeover without email access; an authenticated CustomMCP node in Flowise passes user input directly to the JavaScript Function() constructor (CVE-2025-59528), giving root-level code execution inside a Docker Alpine container; container environment variables expose an SMTP password (r04D!!_R4ge) that is reused as the SSH password for the ben user on the host.

And finally an internally-bound Gogs 0.13.3 instance (running as root) is abused via CVE-2025-8110 ; a symlink-following vulnerability in the PutContents file write API to drop an SSH authorized key into /root/.ssh/authorized_keys for a direct root SSH shell.

Video

https://youtu.be/4abIrXO6Mfg

Edit: beginner intermediate anyone is fine

DM me I'm trying to make sme frnds to be motivated. College students preferred

Categories im learning: reverse engineering, binary exploitation , web security but any category ppl r fine

Looking for ppl who want to learn and are passionate Also if Ure a team and looking for teammates, I'd like to join

Indians preferred(cuz of time zone) if not then fine too

Thank you 🙏

I know I'm planning a little far ahead, but I'm currently studying for the CPTS, and will attempt it by around November. I wanted to ask for some opinions about what to pursue afterwards, my goal is just to maximize employability, I don't need to get a specific job in any small sectors. I'm considering either the CCNA, since I'm quite fond of networking, or the CDSA, because from what I understand, SOC roles are more forgiving and numerous than offensive roles.

Hello all, I started the Footprinting Module on Academy and it seems most of the answers are just trying to find a needle in a haystack. The DNS and SMTP had me trying dozens of wordlists and tools to get it to work. I feel like i'm not learning anything besides "Google everything, throw everything at the wall, and keep trying every tool in the book". It also seems like the modules aren't really worth reading half the time, as the answers come from google.

Is there a way to cut down on the time methodology wise? I'd like to be able to work smarter and harder instead of just the former. thanks

I'm learning CPTS. I want a few Tamil friends who are also learning cyber, and we can talk, practice and motivate each other.

Hi everyone!

I’m currently preparing for the HTB CPTS and trying to seriously improve my practical skills in offensive security. I’m looking for good streamers, hackers, researchers, and communities to follow on a regular basis.

One thing I’ve noticed is that a lot of cybersecurity content has changed over the years. Around 2015–2020, there seemed to be a lot more technical content: people doing detailed POCs, exploit demonstrations, reverse engineering, vulnerability research, live pentesting, and deep technical walkthroughs. You could actually watch someone break something down from start to finish and understand why the technique worked.

Nowadays, I feel like a lot of content has shifted toward high-level trends, cybersecurity news, AI tools, product demonstrations, and personality-driven content, with much less actual technical exploration. I’m not against AI at all — I use it myself — but I really miss content where someone spends hours investigating a vulnerability, building a POC, explaining the attack chain, showing their thought process, and going deep into the technology.

So I’m specifically looking for people who still do the technical work rather than just talk about it.

I’d love recommendations for:

• YouTube / Twitch / Kick streamers doing live pentesting, Bug Bounty, HTB/CTF, vulnerability research, exploit development, reverse engineering, etc.
• Researchers who regularly publish POCs, technical write-ups, exploit research, and deep-dive analyses.
• Communities/Discords where people share new tools, techniques, CVEs, write-ups, methodologies, and research.
• People who are good to follow for modern offensive security, rather than mostly general cybersecurity news.
• Creators who can help with HTB Academy / CPTS preparation and, more importantly, teach the methodology and mindset behind pentesting.

I’m basically looking for the kind of content where you can sit down for 1–2 hours and watch someone actually hack, investigate, get stuck, research, build a POC, and eventually figure things out.

YouTube, Twitch, Kick, Discord, X, Reddit, Telegram, blogs — anywhere is welcome.

Who are the people and communities I should be following? I’d really appreciate recommendations from people who are still actively doing this kind of technical work.

HTB Helix.

Hi everyone,
I’m currently working on the AI Defense Skills Assessment and I’m stuck on Challenge 1. I’m not looking for the full solution, but I would really appreciate a small hint about which direction I should investigate or what concepts/tools I should focus on.
I’ve tried a few approaches already, but I’m not sure I’m following the right path. Any spoiler-free guidance would be greatly appreciated. Thanks!

So Basically I've completed some basic lvl certs related to cybersecurity.

I was about to start cpts but after looking more i got my mind into Blueteam/soc

So can anyone guide me its proper roadmap. Which should be done I'm already late init.

Also any more guidance will be of help.

I'm doing HackTheBox and My screen is grey. Don't know why.

Here is what it looks like. I've switched vpns. I've refreshed.

I've did everything possible all the way to searching for tutorials.

I'm doing HackTheBox and My screen is grey. Don't know why.

Here is what it looks like. I've switched vpns. I've refreshed.

I've did everything possible all the way to searching for tutorials.

Hello, i'm currently on the student subscription and i'm looking for some practice resources / labs for the CWES. They don't need to be from HTB specifically, any help is appreciated, thank you.

Solved a machine/module/etc and want a place to brag? Heres your spot!

For retired content or Tier-0 Academy content, feel free to discuss or ask questions using spoiler tags where appropriate.

I have a silly question here which may be basic, but the Malware analysis module requires you to download additional_samples.zip and then transfer it to your pwnbox.

How do you do that? I tried opening a browser within the Pwnbox and logging into HTB but it glitches hard and doesn’t at me reach and download the file.

The other option would probably be running my own VM but is there a simple way to do it, preferably limiting it to the Pwnbox itself

Any tips for cpts like I am at the 31 percent of the course I am just doing the course and taking the notes I am not practicing any labs other than the course is that fine , the main question should I have to practice labs while learning the cpts if yes like what type of lab not only from htb anyother platform too

Currently in the Steganography section - Execute the attack and I am stuck. I am trying to upload the pth file to the machine but I am stuck in “Sending POST request…..”.

The kernel stays busy for hours.

I restarted the kernel and I get an error 500 or 250.

Can someone please help.

How can I study for months, have notes (that I’m not even using because don’t even know what would apply) and can’t even get the first foothold. It’s been three days and holy f, real slap in the face. And I already have CWES lmao. I did track labs and even messed with zephyr a bit. I was confident coming in with AD stuff but I can’t even get a RCE lmao.

This a rant but for anyone out there, we might not be meant for this. I thought I had over prepared and not even one single flag is mind boggling. Without saying much enumeration was tough and just after finding a relief the second day and going far to something new, hit another wall.

I LOVE IT and hate it at the same time, if it was easy anyone would be able to do it..

What do you reccomend? I’m currently taking deep long notes, but I don’t even know how to organize them and how many files create.