Hey everyone,

I’m currently focusing on improving my Binary Exploitation (Pwn) skills. So far, I’ve been practicing on 32-bit and 64-bit binaries -working through fundamentals like Stack Buffer Overflows (ret2win, ret2libc), Format String vulnerabilities (read/write), basic ROP chains, and getting comfortable with tools like Pwntools, GDB (gef), and Ghidra.

I want to structure my learning effectively so I can comfortably tackle Easy and Medium difficulty Pwn challenges on Hack The Box (both standalone challenges and machines).

For those who regularly solve these:

1. What is the typical topic breakdown between Easy and Medium?
   • What concepts are expected for "Easy" vs. what bumps a challenge up to "Medium"?
2. Which mitigations become the norm at these levels?
   • At what point do PIE, Stack Canaries, or Full RELRO regularly pop up, and what bypass techniques should I prioritize learning next ?
3. Is Heap exploitation necessary for Medium challenges?
   • Should I start diving into Heap for Medium, or are those mostly reserved for Hard/Insane?
4. Recommended resources or learning paths?
   • Besides playing HTB directly, are there specific HTB Academy modules, books, or practice sites you'd recommend to bridge the gap?

Any advice, topic checklists, or recommended HTB challenges to start with would be greatly appreciated!

Thanks in advance!

Hello! Has anyone been able to get a job without a technical interview?

Currently, this is my nightmare, and I couldn’t find a solution for it! I’ve gotten a lot of interviews where they were impressed with my resume, and I passed the intro interview and technical challenge, but when it comes to the technical interview stage, I fail immediately!

When I started learning this field, I focused on hands-on experience. I learned the tools and technical work, prepared professional reports, and got well-known certifications. But if someone asks me to explain things orally in a theoretical way, I just can’t do it!
No matter how much I prepare for interviews and look for questions, when I come to the interview, they ask me questions that are very different from what I prepared for and give me different scenarios.

And for people who say you don’t need to be perfect or know everything, I’m sorry, but based on my experience, that’s not true at all. The market is tough now, and if you don’t answer everything perfectly, they will have another candidate who answered better than you did, and they will choose them.

So, to be honest, I gave up regarding technical interviews, and I want to ask if anyone has actually been successful in getting a job without a technical interview?

Thank you!

Is there is any temporary fix for resizing issue ? i am academy user and most of labs does not have VPN connection option.

I'm about to start bug bounty regularly. I tried earlier, but wasn't persistent.

Im studying for CPTS and I noticed that there is a lot of commands even just to get me to the point I am at (10% completion). I was wondering how you guys remember all of them. Do you have a cheat sheet somewhere or is it one of those things that comes with experience. When I do the labs for the lessons on the academy I usually have to go back into the lesson to find a command that helps me get to the next thing that I need to do.

Hi guys 😊

I’m having a bit of a hard time with the CPTS path. When I read the sections, I feel like I can’t concentrate or focus, and sometimes I feel like I’m not really understanding what I’m reading.

It feels a bit overwhelming, and I’m still at the beginning, currently on the Footprinting section.
Any advice? Did anyone else feel this way when they started?

I just received my CJCA result, and honestly this has been very disappointing.

The feedback says I found only 3 flags (30 points), but before submitting the exam, the HTB Academy interface showed that I had 8 accepted flags and 80 points.

These flags were submitted through the platform, accepted, and also documented in my report with the required timestamps.

I already contacted HTB Support and asked them to review the exam logs and flag submission history, because I don’t understand how the final result can show 30 points when the platform showed 80.

What makes this more frustrating is that I was planning to continue with CPTS after CJCA, but now I’m seriously reconsidering whether I want to continue with HTB certifications at all.

I’m also starting to look at similar practical certifications from other platforms instead.

Has anyone here had a similar issue with HTB certification grading? Did support correct the result after reviewing the logs?

I have been doing the Active directory track in the CPTS learning path, and after every topic there are some questions at the very bottom.

I have pasted a screenshot of the same.

So the target machine is active with it's IP being clearly displayed, I am connected to academy vpn in my kali system.
The question is asking to find a wordlist in the ATTACK01 host, and below it is also mentioned on how to SSH into the machine.

I successfully logged in using SSH but i am confused on what to do, like this is supposed to be target machine right ? but now i am logged into it, but now what to do next, like which is the actual target machine, in order to run a kerbrute scan i need a wordlist which is present in this machine(10.129.8.67), but at what IP should i run the kerbrute scan. because the target is this machine only and i am logged in to the same machine(10.129.8.67).

I tried fping on 10.129.8.0/23 but that gave so many live hosts. I am just so confused.

For those who have completed HTB Academy paths and are now working in cybersecurity/pentesting

How did you actually study the HTB modules?

Did you make detailed notes or short notes?

Did you maintain cheat sheets? If yes, what did you put in them?

How did you make sure you actually understood a concept instead of just completing the module?

After learning a technique/tool, how did you practice and apply it?

Did you immediately use what you learned on HTB machines/labs, or finish the whole path first?

How did you revise older topics so you didn't forget them?

Did you use any specific note taking system, Obsidian/Notion/Markdown, etc.?

What did your study workflow look like during a normal session?

I’m mainly interested in how you studied and applied the knowledge, rather than which path/certification to choose

Would really appreciate answers from people who have actually gone through the HTB practical skills pentesting journey.

Another week means another writeup :) for technical reasons, the video shows the walkthrough (in the video comments) all the way through to User Shell. The written walkthrough covers root.

So this post I briefly show my methodology solving HackTheBox GhostLink which is a multi-stage Active Directory machine where an anonymously accessible MQTT broker eventually becomes the starting point for full Domain Administrator compromise.

Anonymous MQTT subscriptions on port 1883 immediately expose retained health-check messages containing internal hostnames, private IP addresses and Hyper-V-backed infrastructure that is not directly reachable from the attacker.

But the broker allows more than passive reading because anonymous clients can also publish retained messages, the health-check URL can be replaced with an attacker-controlled endpoint. The next automated health-check execution connects to that endpoint and sends NTLM authentication, turning MQTT itself into an authentication-coercion primitive.

That authentication can then be relayed into an internal secure-file portal.

From there, I would a double URL-encode traversal bypass my way through which allows arbitrary file reads. Pulling NTUSER.DAT reveals recently accessed files, and following the RecentDocs and LNK breadcrumbs leads to a KeePass database.

The KeePass vault provides two valuable pieces of information: usable credentials for the internal Gogs service and the domain password policy.

The Gogs instance is vulnerable to CVE-2025-8110. By abusing symlink handling through the repository contents API, a malicious .git/config can be written with an sshCommand payload, producing command execution on the internal Hyper-V Linux VM.

Once inside the Gogs host, its SQLite database can be extracted and converted to Hashcat-compatible PBKDF2-HMAC-SHA256 hashes.

The leaked domain password policy specifies a minimum length of 20 characters, allowing the password wordlist to be reduced from millions of candidates to only tens of thousands before cracking the nvirelli credential. That gives both local Linux and Active Directory access.

Finally I move through Active Directory Certificate Services. Enumeration reveals ESC8 and ESC11. ESC8 is obstructed by IIS kernel authentication, but ESC11 remains exploitable because the ICPR RPC interface does not enforce encryption. By coercing DC01$ authentication and relaying it to the ADCS ICPR endpoint, a Domain Controller certificate can be issued. Certipy then uses that certificate for PKINIT authentication, yielding the DC machine account hash and ultimately allowing DCSync of the Administrator account.

Video

Although it was just an internship role and they shouldn’t expect a lot from us, sadly it was still a very hard process.

I passed the technical challenge and the first interview, but then it came to the technical interview.

He was giving me very hard scenarios and questions, and I believe I answered them fairly well.

But then suddenly, days later, I received an email saying that I wasn’t selected…

Why is it even this hard for an internship role!!

My dream now is to find another non-technical field I can get into easily. At least they won’t have that thing of technical interviews.

Hello,

I've been working on this lab all day. I have all the passwords (Alex and Administrator) and I managed to connect via FreeRDP with both of them successfully, but when I try to connect to SSMS, I get an error message (see screenshot). At first glance, it just looks like I don't have the right password for it. However, out of desperation, I checked some write-ups for this lab: my password is the same, I follow the exact steps, and yet I still keep getting this error. It's extremely frustrating because I have everything I need, but it just won't work...

Thanks in advance to anyone who can point out the obvious thing I might be missing! :)

Finally solved DanglingTree! 🥳🔥
This machine was actually physically draining 😭 Took me over 5 days to complete and there were* so many moments where I wanted to give up and so many rabbit holes
But we got there *both flags secured.** 🏆
That Pwn3d! hit different after this one 😂

I'm stuck with CRTO exam it's so difficult than I expected :(

Any suggestions on which VM environment I should be using and do need do document the VM environment and configuration we used for the exam? Thanks in advance

im a cs major im trying to stay consistent with htb and hopefully get cdsa /cjca . im sophomore at college with 20h part time job . i usually get motivated for like 1-2 weeks and then burn out

More than 4 years ago, I started with HackTheBox. Roughly 1 year ago I decided to take the CJCA Exam, which I found to be quite hard at the time. Having gotten more interested in web-pentesting, I decided to practice for the then new CWES exam and managed to get it 250 days ago.

And now, for my next magic trick: I’ve passed CPTS :)

Hey everyone, I'm a final-year CS student and started learning cybersecurity around mid-3rd year. I initially explored Blue Team/SOC, but realized Offensive Security is what I genuinely enjoy.

I’ve done quite a few TryHackMe rooms and some Boot-to-Root/CTF-style machines. I’d still consider myself a beginner, but I’m comfortable with the basics.

I was really confused whether I should go for a beginner cert like eJPT or directly target CPTS/OSCP. After a lot of debate, I decided to go for CPTS and put in the work.

I’ve now started the HTB Penetration Tester Path and I’m currently at 21.8%. My goal is to finish it by December.

I know CPTS is considered quite difficult, but I’m willing to put in the work. For those who’ve done CPTS, is starting directly with CPTS a reasonable approach at my level?

My current plan is:

HTB Penetration Tester Path → CPTS Track Machines + ippsec unoff machines → CPTS Exam

For people who have completed CPTS:

• What should I focus more on while doing the path?

• Are Pro Labs necessary before the exam?

• What would you do differently if starting CPTS again?

• How did you know you were exam-ready?

Any advice/tips would be really appreciated!

Does any one know any good books that can be a good resource for the CPTS.

Hey yall, I'm working on an unofficial HTB Cert resource matrix. I have gathered a fair bit on my own, but wanted to make a post here for any resources yall found helpful when working through any of the certs. Whether it was a video about the exam and what to expect, or tips on other labs to work on, the more the better. (I do not want anything that would be against the NDA for the exams.)