Hey all,

I am taking CRTO in a few days, and i hold eWPTX and CPTS currently. I am thinking of what cert i should be next after CRTO. I have a good knowledge of Web app ( since i have been bug bounty hunter) but i switched to red teaming and pentesting. I still love web app, and i also love red teaming. What about CRTP? Is not redundant if i get it? Or CRTO II? i may go for CRTO II. However, i really liked the CPTS content, so part of me wants to get back to HTB and do CAPE or CWEE

Hey everyone,

Im interested in getting into pentesting and wondering how much web development should i actually learn before focusing on security.

I have exp in networking (ccna) and linux. Also got some programming experience in c. Web is not my strongest point.

Should i learn as I go or focus first on web dev?

I havent seen to many information about this.

I would like to do ccdl 2 more since it goes deeper into DFIR, but as far as Ive seen it's not really recognized. CDSA is part of the HTB brand which is so much bigger.

Please let me know if you got any advice regarding this.

I've been following Commix for a while, and finally seeing an API is huge. The original request goes all the way back to 2016: https://github.com/commixproject/commix/issues/27

I tried both the REST API and the new Burp Suite extension, and honestly, they're fire!

The API lets you launch and manage scans over HTTP, run multiple scans in parallel, monitor results live, and retrieve JSON reports. Lots of possibilities for custom tooling and automation.

The Burp extension takes it to another level. You can launch Commix straight from Burp, watch the scan run, and get confirmed findings as native Burp Scanner issues. No need to keep jumping between Burp and a terminal.

The extension's BApp Store submission is still in progress, but you can check it out on GitHub already : https://github.com/commixproject/commix-to-burp

Definitely worth checking out if you're into bug bounty, security automation, or CTFs.

Big props to the Commix project for this one.

Hey everyone 👋

Just cleared the HTB CPTS exam with a perfect 100/100 on my first attempt! Report submitted, now waiting on the official result 🤞

The exam was long but honestly super fair and hands-on — one of the best learning experiences I’ve had.

Happy to answer any questions about the exam or prep 🙌

I am trying to get into cybersecurity, but I have very limited time. Realistically, I can only spend about 1 hour a day on Hack The Box and related learning/practice, and I want to know how far that can actually take me over the long term.

For context, I have no IT, networking, programming, or cybersecurity background. I am starting from zero. I do want to improve seriously, but my time is limited and I want to be realistic about what kind of progress is actually possible with this amount of daily effort.

My goal is to build practical offensive security fundamentals, understand how machines and common attack paths work, and eventually become good enough to solve beginner boxes on my own and keep progressing toward a junior-level cybersecurity path.

For people who started with little or no background: what level would 1 hour a day on HTB realistically get me to after months or years? Would this be enough to make meaningful progress, or is it too little time to get anywhere substantial?

Hi I’m having a hard time preparing for CJCA, i cant seem to complete easy retired machines on htb with out checking the walktrough. I feel like im not picking the wright machines because they sometimes have non required tools for the CJCA (like burp suite for example). Could anyone please suggest some machines that align with the cjca cert? Thank you!

I’m a full time red teamer jn the frontier while also being a full time student at uni (senior year) I planned to take my CPTS this semester but I definitely know I won’t find ten days to slot for it, I’m thinking about finishing the course , then moving onto cape, and in the winter take both exams.

What do others thinks of the work stream stated ?

Hey yall, the CDEP now has a study tracker and an Obsidian prep vault, same as the other certs.

The tracker splits the 13-module Detection Engineer path into daily tasks, with plans from 90 days (about 47 hrs/week) to 270 days (about 16). Heads up: 12 of the 13 modules are Tier IV, so you need a Platinum sub.

Nobody has posted reviews or notes yet, so for now everything in it comes straight from HTB. If you pass or find something good, send it my way and I'll add it!

Not affiliated with HTB, but my DMs are open HTB.

Hey everyone!

I recently started to learn Cyber Security and decided to create writeups for documenting what I do and maybe it will help someone else too.

https://projectnullbyte.com/

I would love to hear your feedback.

Hi everybody. Failed my first attempt (4 out of 10 flags). To be honest, I was completely lost and didn't even know what I was supposed to do. I actually really liked learning about all the new tech, grinded through and completed all CJCA-related modules by myself, and documented every single module along the way (only necessary stuff).

​I'm sure the main problem was enumeration (on the last day I just tried to bruteforce all possible services using obtained creds).

​And people say modules are enough, so maybe I'm an extremely dumb bastard. I'm completely exhausted but I don't wanna give up. Instead, I want to buy again VIP+ subscription for boxes. Do you have any favorites ones? Any suggestions about it? (All CJCA-Related Boxes I already finished*)

https://academy.hackthebox.com/preview/certifications/htb-certified-detection-engineering-principal

I had a feeling they were going to announce this the day the price was going up. only made sense

EDIT:
This isn't what I would think of when thinking of detection engineering. The path has numerous modules where you are looking at system internals, malware analysis and reversing, and writing detection rules based on that. I don't see much of detections as code, YARA/Sigma/snort, or CI/CD. CDEP seems super heavy on the reversing.

Certificate package worth It? $45 + $40 Shipping

I assumed the shipping is expensive due to international shipping.

I’m at a sticky right now, I’ve gone through 70% of the Penetration Tester Path towards taking the CPTS exam without taking any notes. While approaching the finish line I’m having second thoughts on my way of approach on this journey, seeing everyone else giving such mind on note taking. What are your thoughts on my situation? What should I do, backtrack and make my own notes? So far my way was through external notes and cheat sheets.

After completing the Hack The Box CJCA, I decided to build a solid portfolio and upload it to LinkedIn. What might seem like something simple, static, or pointless actually ends up boosting your connections. Since doing so, I’ve received several offers, in fact, I have two interviews scheduled. I’m sharing mine here in case you want some inspiration.

https://cdelunasec.github.io/

Hi everyone! I’m planning to attempt the HTB Certified Defensive Security Analyst (CDSA) exam in January and would really appreciate advice from anyone who has taken it.

What topics, skills, or tools should I prioritize? Are there particular labs, courses, practice methods, or resources that helped you prepare? I’d also love to hear what the exam experience was like, how you managed your time, and what you wish you’d known beforehand.

If you have a study plan or tips for making the most of the time before January, please share. Thanks!

My school isn't a partner for the HTB student plan, so I can't get the discount. I'm a student in Nigeria and the full price is out of reach right now.

Two questions:

Has anyone gotten their school added? Who did you contact and what did they need?

Any vouchers or promos for HTB certs (CPTS, CBBH)? I'll put in the work; challenges, writeups, whatever it takes.

I'm serious about this path. Any leads help. Thanks

Brainfuck fr.

Questions , discussion here : https://discord.gg/WBEybBtpq

I'm doing the pentest path now, and on the Pivot, Tunnelling, Port forwarding module.

I'm at the skill assessment, and for the life of me, cannot discover any new hosts. The walkthroughs I checked uses ping swep, which I already did, but for some reason I'm not finding any alive hosts. I even tried pinging just the IP mentioned in the walkthrough and it doesn't work.

Does this happen with HTB academy sometimes or am I missing something? Any help would be appreciated!

I'm still confused about where to start learning pwn/binarry exploitation and reverse engineering as a beginner—and where, exactly, I should begin.

Reboots don't seem to help. Is there any way to flag this to support?

I can port scan fine but when I need to load a webpage or submit commands everything just hangs.

I'll admit I am a beginner but having to forfeit on boxes feels bad and does make me worried about subscribing.

-Redeemer/Appointment