HackTheBox

What is HackTheBox?

HackTheBox (HTB) is one of the best-known ethical hacking platforms in the world. It offers vulnerable machines you connect to over VPN and compromise end to end, standalone challenges by category (web, crypto, reversing, forensics, pwn…), professional labs that simulate corporate networks, and a training academy with its own certifications. Unlike more guided platforms, HackTheBox machines usually give you just an IP and the goal of capturing the user and root flags: you find the path yourself.

What HackTheBox is used for

• Practising realistic pentesting: enumeration, exploitation and privilege escalation on Linux and Windows.
• Preparing for hands-on certifications such as the OSCP (from OffSec) or HTB's own, like CPTS or CBBH.
• Training Active Directory and lateral movement in the professional labs.
• Defensive training with forensic investigation challenges (Sherlocks) and the analyst path.
• Building a portfolio: your profile and ranking are a common calling card in hiring processes.

The parts of HackTheBox

• Labs (machines): active machines, which rotate and count towards the ranking, and retired machines, which have official writeups. Access to retired machines usually requires a subscription.
• Starting Point: heavily guided machines designed for getting started from scratch.
• Challenges: puzzles without a full machine, by category.
• Pro Labs: simulated corporate networks with multiple machines.
• HTB Academy: theory-and-practice modules organised into career paths, with certifications such as CPTS (pentesting) or CBBH (bug bounty).

Getting started with HackTheBox

1. Create your free account and open Starting Point.
2. Download your VPN file from the connection panel or use Pwnbox, the in-browser attack machine (time-limited depending on your plan).
3. Connect and spawn the machine:

sudo openvpn lab_your-username.ovpn
ip a show tun0

The tun0 interface shows your IP inside the VPN (you will need it for reverse shells). Next, a typical initial enumeration flow:

nmap -p- --min-rate 2000 -oN ports.txt TARGET_IP
nmap -sC -sV -p 22,80 -oN services.txt TARGET_IP
gobuster dir -u http://TARGET_IP -w /usr/share/wordlists/dirb/common.txt

And, once inside, a listener to catch a shell plus some basic Linux privilege escalation checks:

nc -lvnp 4444
sudo -l
find / -perm -4000 -type f 2>/dev/null

Only attack the machines assigned on the platform: anything else is out of scope and illegal without authorisation.

Recommended learning path

1. Build your Linux and networking basics (for example with OverTheWire or TryHackMe).
2. Complete the Starting Point tiers.
3. Do retired Easy machines and, when finished, read the official writeup or community videos to see which paths you missed.
4. Move on to Medium machines and to active machines without help.
5. Study the HTB Academy path that matches your goal and consider one of its certifications or a Pro Lab.

Pricing

HackTheBox has free access (active machines, basic Starting Point, some challenges and Academy modules) and paid subscriptions for labs (VIP) and Academy, plus separate payments for Pro Labs and exams. Plans change often, so check current pricing on their website.

Pro tips

• Enumerate more than you think you need to. Most dead ends come from an undiscovered port, vhost or directory.
• Add the machine's domains to /etc/hosts when the website redirects to a hostname.
• Write your own writeup for each machine: it locks in the learning and becomes portfolio content (only for retired machines; the rules forbid publishing solutions for active ones).
• Use Burp Suite for everything web and practise first at PortSwigger Academy.

Pros and cons

Pros	Cons
High-quality, realistic machines	Steep entry curve without prior basics
Widely recognised by employers	The best parts (retired machines, Pro Labs) are paid
Offensive and defensive, with its own certifications	Shared machines on the free plan can be slow

HackTheBox alternatives

• TryHackMe: more guided, better for beginners.
• VulnHub: free downloadable machines for your lab.
• Root-Me: free challenges by category.
• OffSec courses: if your goal is the OSCP.

Frequently asked questions

Is HackTheBox free?

It has a free plan with active machines and part of the content, plus paid plans for retired machines, full Academy access and Pro Labs. Check current pricing on their website.

Is HackTheBox for beginners?

Starting Point and Easy machines are, but you should arrive with Linux and networking basics. If you are starting from zero, TryHackMe is usually a gentler first step.

What is the HackTheBox CPTS certification?

It is HTB Academy's pentesting certification: a hands-on exam where you must compromise an environment and submit a professional report.

Can I publish HackTheBox solutions?

Only for retired machines and challenges. Publishing solutions for active content breaks the platform's rules.

If you want to arrive at HackTheBox with well-trained terminal skills and methodology, practise first at the Hackers en Acción Academy.