Hi all,

I’m working through the Android Fundamentals module on HTB Academy and I’m stuck on the skill assessment. The question is:

Sign the application myapp.apk and install it by either dragging and dropping it onto the device or using ADB. Make sure to first uninstall any previous versions of the app. After installation, tap on the app to start it. What is the message printed on the screen?

What I’ve done so far:

Generated a keystore with keytool [keytool -genkeypair -v \

-keystore my-release-key.jks \

-alias myapp \

-keyalg RSA \

-keysize 2048 \

-validity 10000]

Signed the APK with [apksigner / jarsigner], using [apksigner sign \

--ks my-release-key.jks \

--ks-key-alias myapp \

--out myapp-signed.apk \

myapp.apk]

Verified the signature with [apksigner verify --verbose --print-certs myapp-signed.apk]

Uninstalled the previous version

Installed via ADB

Launched the app, and the message I see is: “Hello from C++”, which the platform marks as incorrect

Setup: Android-x86 in vmware workstation

recommended pathways?

What are the Ranks flow and how much xp needed for different ranks ??? and what is grade here?

:) idk what to say, felt like had it all, felt like hitting all the dead ends.. ahhhhhh :,) 😭😭😭😭

Hey all , I noticed the thought of opening htb , finding machine spawning it and opening tools was making me procrastinate alot , so I made a custom widget that does all that in one click . Its still in development , I will be making it opensource .

Tell me what features would U like to see in the widget .

Repo link : https://github.com/vedant-sec/OneClickHTB.git

Hi everyone,

I’m looking for advice on moving from network security into a more cybersecurity-focused role.

I'm 27, i have 7 years in networking and network security (no university degree), currently a Network & Security Specialist managing enterprise firewalls and network infrastructure: FortiGate, Cisco Meraki, F5, Cisco ISE.

About 7-8 months in a SOC (network security side: firewall troubleshooting and incident support on Check Point, FortiGate, Palo Alto), no pentesting or detection work in my current role, and no SOC at my company.

I have Fortinet NSE 7, Cisco Meraki Solution Specialist, CCNA (expired), Sec+ (expired), PJPT.

Do you guys think the CPTS can realistically help me pivot into pentesting or a security role?

Thank you so much for your time!

If you're a beginner or at an intermediate level in Cybersecurity and genuinely interested in learning, exploring, and growing in this field, feel free to DM me.

Let's connect, share knowledge, collaborate, and grow together!

Hey everyone,

A while back I shared a modified version of u/Cnmoseman’s CPTS tracker in the comments, and he said I could share it, so I wrote it up properly.

What I added:

• 2 modules: Using CrackMapExec and Active Directory PowerView (30 modules / 531 sections total, up from 28 / 495)

• Focus Timer tab: Pomodoro, Deep Work and Flow modes, custom profiles, session notes, stats, JSON/CSV export

• Custom timeline: pick any number of days or set hours per week

• Backup now includes your focus sessions

It’s still a single offline HTML file. Everything saves in your browser, so export a backup now and then.

Download + full breakdown: https://kennytherex.dev/cybersecurity/cpts-study-tracker

All credit for the original goes to u/Cnmoseman, and his tracker is built on mattrfield’s coae-study-tracker. Feedback is welcome, and if you have module suggestions I’m happy to look at

OK, I'm working through the CPTS Prep track and I'm on the last machine: Ghost. Now, I'm a beginner who's only a couple of months into doing this sort of thing, so I knew I'd definitely need some write-up assistance to complete an "Insane" machine that has reviews calling it the hardest machine on HTB. As such, I'd do little chunks of what I could figure out on my own, then ultimately turn to the write-up. I had to spend a fair amount of time getting some of the tools like Rubeus configured properly on my machine (arm64 Macbook Pro running Kali on UTM) but ultimately, with the help of the official write-up, I got as far as the very final step.

I'm shelled up as `nt authority\system` and I run the mimikatz command the write-up supplies: all good. I then run the rubeus command and get `[+] Ticket successfully imported!`. Awesome! Just one more step!

`dir \\dc01.ghost.htb\c$\Users\Administrator\Desktop`. Uh-oh! Here's what happens:

dir \\dc01.ghost.htb\c$\Users\Administrator\Desktop

dir : Access is denied

At line:1 char:1

+ dir \\dc01.ghost.htb\c$\Users\Administrator\Desktop

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : PermissionDenied: (\\dc01.ghost.ht...strator\Desktop:String) [Get-ChildItem], UnauthorizedAccessException

+ FullyQualifiedErrorId : ItemExistsUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand

dir : Cannot find path '\\dc01.ghost.htb\c$\Users\Administrator\Desktop' because it does not exist.

At line:1 char:1

+ dir \\dc01.ghost.htb\c$\Users\Administrator\Desktop

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : ObjectNotFound: (\\dc01.ghost.ht...strator\Desktop:String) [Get-ChildItem], ItemNotFound

Exception

+ FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetChildItemCommand

I got the same thing trying just `dir \\dc01.ghost.htb\c$`

So I turned to a second, external write-up that had a different ending sequence: https://ch3ng625.github.io/ghost

I went through the same steps he went through, got the same successful output from the commands that were supposed to set up the final command, and when it came time for the moment of truth:

PS C:\Users\Public\Music> dir \\dc01.ghost.htb\c$

dir \\dc01.ghost.htb\c$

dir : Access is denied

At line:1 char:1

+ dir \\dc01.ghost.htb\c$

+ ~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : PermissionDenied: (\\dc01.ghost.htb\c$:String) [Get-ChildItem], UnauthorizedAccessExcept

ion

+ FullyQualifiedErrorId : ItemExistsUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand

dir : Cannot find path '\\dc01.ghost.htb\c$' because it does not exist.

At line:1 char:1

+ dir \\dc01.ghost.htb\c$

+ ~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : ObjectNotFound: (\\dc01.ghost.htb\c$:String) [Get-ChildItem], ItemNotFoundException

+ FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetChildItemCommand

When I run klist I see:

Cached Tickets: (1)

#0> Client: Administrator @ corp.ghost.htb

Server: cifs/dc01.ghost.htb @ GHOST.HTB

KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96

Ticket Flags 0x40a50000 -> forwardable renewable pre_authent ok_as_delegate name_canonicalize

Start Time: 11/12/2026 11:07:51 (local)

End Time: 11/12/2026 21:07:51 (local)

Renew Time: 11/19/2026 11:07:51 (local)

Session Key Type: AES-256-CTS-HMAC-SHA1-96

Cache Flags: 0

Kdc Called:

But when I run `klist get cifs/dc01.ghost.htb` I see:

klist get cifs/dc01.ghost.htb

Current LogonId is 0:0x3e7

Error calling API LsaCallAuthenticationPackage (GetTicket substatus): 0x520

klist failed with 0x8009030e/-2146893042: No credentials are available in the security package

I'm completely stuck. This was hard enough for me even when the write-up was working but when even doing total karaoke doesn't work? Dang. I don't want to suggest "the box is broken" because I'm way too novice to just assume I'm not missing something obvious and stupid, but... does anyone see anything obvious and stupid I'm missing?

I have a lot of trouble DNF'ing a box (especially one that would complete a track), just on a mental level.

I put together a video series on how I structure an AI agent workflow for web security research. It is not a tool that finds bugs for you. It is a way to organize the work in files, so the agent follows your rules, uses your notes, and stops when something does not pass a check.

What it covers:

- why the workflow lives in files instead of one long chat

- a rules file, a knowledge folder built from your own notes, and phases run one at a time

- a gate script that refuses to move on when something is missing, with tests

- scope rules, recon, an audit of the wiring, validation before any report

- memory and maintenance, so mistakes turn into rules

If you have done the CWES or CPTS path, the knowledge part will feel familiar: you turn your notes into files the agent reads before it acts.

It is one short intro and 17 animated episodes. Every important file in the repo comes with a template and a prompt to make your own version.

Only use it where you are allowed to: your own lab, or programs whose rules allow automation and AI tools.

Playlist: https://www.youtube.com/playlist?list=PLVSBaEIS7tEE

Repo: https://github.com/w1j0y/w1j0y-workflow

Happy to answer questions or take feedback on what is unclear.

Hi everyone,
I'm a computer engineering student. I plan to do my master's in networking, and I'm also planning to join a networking bootcamp and go for the CCNA certification. I want to move into security and pursue networking and cybersecurity side by side. Within cybersecurity, I'm most interested in pentesting, bug bounty hunting, and network security.
Imagine I'm starting from absolute zero. So far I've started studying the Hack The Box CJCA path, and alongside it I've been learning Python. My networking foundation will come from the bootcamp and CCNA prep, and I also want to learn Linux in parallel.
But after watching a ton of YouTube videos, I feel like my path might be wrong, and I'm confused.
My questions:
What's a solid roadmap for building a foundation from scratch in pentesting and bug bounty?
In what order should I learn things (CCNA/networking, Linux, Python, web fundamentals, etc.)?
Is jumping into HTB CJCA this early a mistake, or is it fine to do it alongside the bootcamp and CCNA prep?
Which free or cheap resources, labs, and platforms would you recommend for a beginner?
Any advice, roadmaps, or personal experience would be really appreciated. Thanks in advance!

after 3 year in this field
with htb grandmaster
now no goal + no job
no next step
what i do
any one can help me
to end "burnOUT"

I want to start a discussion, what do you guys think about how this model will impact our CTF's

I'm planning to attempt the HTB CPTS exam for the second time and have a question for those who have retaken it.

If the environment is the same, would I be able to reuse my notes from the first attempt and pick up where I left off and reuse my report from the 1st attempt? (I left off at 11th flag)

I'd appreciate hearing from anyone who has taken the CPTS exam more than once, especially those who have recently retaken it.

Thanks in advance!

Is it normal to not be able to solve the CPTS lab track without help/seeking for solution? I heard that you should try to do as much of it without any help using Adventure mode. I've been stuck for awhile, yet I cant help but feel that I'm not ready and should just look at the solution. Currently feeling discouraged but idk... is this normal? I have finished the academy and modules but when it comes to these lab machines, im unable to proceed after initial nmap scans. Can't help but feel a little discouraged and think im not yet ready for the cpts exam.

Any tips/suggestions?

Hey everyone,

I’m looking to get into pentesting. So far i learned the basics of networking (CCNA, don’t have the cert) and got some experience in web dev.

Don’t know much about AD so i’m thinking if it’s better to start with web pentesting since I’m somewhat familiar with it.

Also I heard that CPTS covers around 60% of CWES so idk if I should just go for CPTS.

Btw this is just a hobby I don’t expect to make employment lol

Solved a machine/module/etc and want a place to brag? Heres your spot!

For retired content or Tier-0 Academy content, feel free to discuss or ask questions using spoiler tags where appropriate.

HTB exams have 3 timers.

The exam time: CPTS is 10 days, CDSA is 7 days.

The PWNBOX time: 6 days and 12 hours.

The environment time: 5000 minutes.

If you want to extend the environment/PWNBOX time, you have to wait for the last 100 mins the click the (+) Button that only gives you 6 hours of extra time. Many times, I would need to walk up at 3 am to click the button before I go to sleep. I hate that. Why don't you just make the environment/PWNBOX time equal to the exam time. I don't get it.

Are we expecting BF deals for the Academy subscriptions ?

I use to watch ippsec videos before covid and used to practice alongside with it. Now i want to again start. What would be right step here? Has the method changed or something? Please suggest

Hey everyone,

I have the option to pursue either CRTP (Altered Security) or CPTS (Hack The Box), but I'm confused about which would be more valuable when applying for jobs in India.

Would appreciate advice from people working in the Indian cybersecurity industry.

Thanks!

# TECHNICAL SKILLS

**SIEM & Security Operations:** Splunk, Elastic Stack (ELK), log analysis, security event monitoring, alert investigation, incident reporting.

**Detection Engineering & Threat Hunting:** Sysmon, Elastic detection rules, Atomic Red Team, MITRE ATT&CK mapping, threat hunting.

**Malware Analysis & Reverse Engineering:** Static and dynamic/behavioral analysis, YARA, Ghidra, IDA Pro, PowerShell and .NET payload analysis.

**Network & Offensive Security:** Wireshark, network traffic analysis, Nmap, reconnaissance, vulnerability assessment, OWASP Top 10, Active Directory enumeration, Linux and Windows privilege escalation.

**Programming & Scripting:** Python, PowerShell, JavaScript, C, C++, Rust, x86 Assembly.

# PROJECTS

## ELK-Based SOC Lab | Security Operations & Detection Engineering

- Built a lab SOC pipeline ingesting Windows/Sysmon events and Zeek network telemetry into the Elastic Stack.
- Simulated adversary techniques with Atomic Red Team and validated corresponding detection coverage.
- Created and managed custom Elastic detection rules in TOML, mapped detections to MITRE ATT&CK, and used the Elastic Detection Rules API.

## Domain Compromise Investigation | Incident Response Lab

- Investigated a simulated Active Directory compromise using Splunk and identified DCSync activity associated with an attempted theft of the krbtgt hash.
- Reconstructed the attack timeline and mapped observed techniques to MITRE ATT&CK in a structured incident report.

## XWorm RAT | Malware Analysis & Reverse Engineering

- Analyzed the infection chain from an initial script through PowerShell to in-memory .NET payload loading.
- Identified persistence mechanisms, keylogging behavior, and command-and-control (C2) infrastructure through behavioral and code-level analysis.


## CVE-2025-32463 – Rust Security Research PoC

- Ported a proof of concept for CVE-2025-32463, a Linux local privilege-escalation vulnerability in sudo's chroot handling, to Rust.
- Explored the vulnerability's underlying behavior and the interaction between chroot configuration and Name Service Switch (NSS) loading.


# CERTIFICATIONS & TRAINING

- **Hack The Box Certified Defensive Security Analyst (CDSA)** — Earned August 2026
- **Hack The Box Academy SOC Analyst Path** — Completed
- **Hack The Box Academy CPTS Path** — In progress
- **TCM Security** — Detection Engineering for Beginners course

# ADDITIONAL PRACTICAL ACHIEVEMENTS

- TryHackMe profile ranked in the top 3%, 100+ labs solved.

RESUME: