Learning paths
Ordered paths that chain catalogue machines, guides and cheat sheets. Tick each step when you finish it: your progress is stored in this browser, no account needed.
From scratch (you are comfortable with Linux and the terminal)
Zero to OSCP
Six stages in order, from your first nmap to a mock exam: Hack The Box machines, guides and cheat sheets to prepare for the OSCP without getting lost.
6 stages ·
34 machines ·
10-14 weeks at about 10 h a week
StartContinue →
You can already escalate on Windows and have seen Kerberos
Active Directory red teaming
From enumerating a domain to ADCS, delegation, relay, C2 and evasion: Windows Hack The Box machines ordered by technique, with their cheat sheets.
7 stages ·
22 machines ·
8-10 weeks at about 10 h a week
StartContinue →
Beginner: you know HTTP and have used Burp before
Web pentesting: from the web to root
The web vulnerabilities you see most in CTFs and real assessments, each with its guide, its cheat sheet and boxes where it is the way in.
5 stages ·
12 machines ·
4-6 weeks at about 8 h a week
StartContinue →
Methodology checklists
Lists to go through on every box or engagement, from enumeration to Domain Admin. What you tick stays in your browser.
Checklist
Recon and enumeration
What to check when you start any box: TCP and UDP ports, versions, each service and the web surface, before firing a single exploit.
20 items
Checklist
Web application pentest
Methodology for a web application: map the app, authentication, access control, injections, file uploads and business logic.
27 items
Checklist
Active Directory
Methodology for a Windows domain: unauthenticated enumeration, first user, BloodHound, Kerberos, ADCS, ACLs, delegation and on to Domain Admin.
22 items
Checklist
Post-exploitation and privesc
What to do as soon as you land a shell: stabilise it, enumerate the system, escalate on Linux or Windows, hunt credentials and pivot into the internal network.
22 items