[TheVHSBoy]

Hello everyone! I'm delighted to share my journey into the field of ethical hacking and begin my HackTheBox experience. I've always been interested in cybersecurity and decided to take the plunge.

[TheVHSBoy]

Very good my friend !!

I hope you have a good experience, hackthebox is very hard to start, but it can be done. Go for it my friend, and don't cheat too much, that's useless if u want to learn something

i can's say it is hard i am enjoying learning on it, if i can say a bad thing is that i am moving forward too slowly, so i think at some point i would need to learn more out of this platform.

[TheVHSBoy]

Good, keep learning.

HTB will teach you thinking differently in a creative way. Maybe, you won't see the exact attack chain in real-world assessments. But it will be helpful for your mind. Think like it is math. it improves your hacking brain.

Watch IppSec contents, and read all of 0xdf writeups. When you don't understand concepts, take time to learn related technologies and their own attack surfaces.

I'm really getting into HackTheBox, and your advice to treat it as a creative thinking exercise make a lot of sense, and I will surely take your advice carefully and look into IppSec's and 0xdf's writeups cuz it appeared to me after some research to be a treasure for learning, and i hope you give me some advises or personal experiences or specific tasks on HackTheBox that you found especially interesting or challenging.

---

---

---

Hello everyone! I'm delighted to share my journey into the field of ethical hacking and begin my HackTheBox experience. I've always been interested in cybersecurity and decided to take the plunge.

Let's take a closer look at the addictive challenges that HackTheBox has to offer, with a particular focus on 'Aragog' and 'Apocalyst'.  
These challenges serve as good benchmarks to improve your penetration testing skills. 

---

Aragog: Unraveling the Complex Web  
Level: Medium 
Aragog's mission is to find both user.txt and root.txt in the labyrinth of vulnerabilities.  
The journey begins with a careful scan using Nmap to reveal open ports 21, 22, and 80.  In particular, anonymous FTP logins open the way for  exploration.  FTP exploration revealed an interesting test.txt file that introduces his XML-based Subnet_Mask hint.  It makes clever use of XML External Entity (XXE) injection to traverse  /etc/passwd and protect SSH-RSA keys.  Finally, user.txt is captured and the permissions of root.txt are extended. 

---

Apocalyst: Navigating the Apocalypse 
Level: Intermediate 
Apocalyst presents a moderate challenge with the ultimate goal of discovering user.txt and root.txt.  Port enumeration with Nmap shows open ports 22 and 80.  
Your web journey begins and leads you to the Apocalypse Preparation Blog.  Investigating WordPress vulnerabilities using wpscan and directory enumeration leads to the Rightiousness directory.  Steganalysis plays an important role as it reveals hidden list.txt files from images.  Wpscan also exposes  credentials, paving the way for Metasploit exploits.  This journey includes privilege escalation, decryption of base64 encoded secrets, and culminates in the victory of user.txt and root.txt.  It's an apocalypse-themed adventure full of twists and turns.

---

you can read more about those challenges from here:
apocalyst
aragog

[r0001]

Stuck On Privesc Every Fking Time
I am getting nowhere with getting root access by myself. I am able to get pwn the user easily but never the root user. I always need hints and most of the time, even walkthroughs.
Can You Guys Suggest some resources or something to improve my skills?
Thanks 

[lethalwarrior619]

Stuck On Privesc Every Fking Time
I am getting nowhere with getting root access by myself. I am able to get pwn the user easily but never the root user. I always need hints and most of the time, even walkthroughs.
Can You Guys Suggest some resources or something to improve my skills?
Thanks 

I am too in the learning phase. I would recommend you to try guided mode and then try it without looking at hints.

[Sammarking]

I'm also going to begin learning soon. I have been interested about it for sometime but I haven't yet started. I wish you best of luck in your journey.

[Phuckchop]

Learning takes time, my friend.

[andr0l1]

Oh, congratulations and good journey.