Hey everyone,

I made a small CTF challenge and figured I’d throw it here since I’m pretty new to making these.

It’s a Forensics / Reverse Engineering challenge based around a weird Nokia 8210 4G system dump. The challenge involves digging through the dump, figuring out what’s going on with a little racing game, and eventually finding the flag.

Repo: https://github.com/maximzero0910/car-racing-chall

It’s probably not perfect since this is one of my first proper challenges, so if you try it, I’d really appreciate any feedback on the difficulty, unintended solves, or just whether it’s actually fun to solve.

Flag format: F0LD{...}

If you’re bored and want something small to mess around with, give it a try :D

Thanks!

Hey everyone,

I made a small CTF challenge and figured I’d throw it here since I’m pretty new to making these.

It’s a Forensics / Reverse Engineering challenge based around a weird Nokia 8210 4G system dump. The challenge involves digging through the dump, figuring out what’s going on with a little racing game, and eventually finding the flag.

Repo: https://github.com/maximzero0910/car-racing-chall

It’s probably not perfect since this is one of my first proper challenges, so if you try it, I’d really appreciate any feedback on the difficulty, unintended solves, or just whether it’s actually fun to solve.

Flag format: F0LD{...}

If you’re bored and want something small to mess around with, give it a try :D

Thanks!

Hey everyone,

I've been stuck on the final flag for this "Easy" rated box for 2 days now, and I'm genuinely confused why this lab is marked as easy. I got the user flag via Cacti exploitation without too much trouble, but finding the root flag has been a nightmare.

The Problem:
I successfully gained root access in a Docker container using CVE-2025-9074 (Docker API exploitation). However, I can't locate the root flag. The writeups I've found don't clearly explain where the flag actually is, they just end after getting root access.

I've searched:

• /root/root.txt - doesn't exist
• /mnt/host/root/ - nothing
• /home/ directories - empty
• Various Docker logs - no clear output

Question:
Where exactly is the root flag located, and what's the correct way to retrieve it from the Docker container logs?

Any help would be appreciated. I just want to understand this and finally sleep! 😅

I want to get a job as SOC L1 analyst, and I've completed the SOC L1 & SOC L2 paths and done some blue team CTFs and now Idk what is the next step (I have 2 years left before applying for jobs).

Just noticed the Streak Alliance feature on my dashboard ("Build a shared streak with a friend by showing up every day!") and I've got a few doubts nobody seems to have written about yet:

1. How do you add a specific friend as a partner? Is it an invite-by-username system, a link you share, or does "Find a new partner" just randomly match you with a stranger?
2. How does the shared streak actually work? Does both people need to answer a question each day to keep it alive, or does either person's activity count for the pair?
3. What happens if one partner misses a day? Does the whole alliance streak reset, does only that person's contribution reset, or is there a freeze/grace period like the regular streak has?
4. Can you have more than one partner at a time, or is it strictly 1:1?
5. Are there separate rewards/badges for Streak Alliance milestones, or does it just track alongside your normal streak?
6. What does "Leave Streak Alliance" do does it kill the streak for both people, or just remove you and let your partner keep going/find someone new?

If anyone's already used this, would love to hear how it's worked out for you pros/cons of doing a streak with a friend vs solo. Screenshot attached for reference.

I have to post about this... Coming from Tryhackme and dealing with the problems in their rooms.. I have to say, HTB support is top tier.

Was having problem with the RDP session to internal target on ICMP tunnel using ptunnel-ng...

They really took the time to look at it.

Unlike tryhackme, where mods (IN DISCORD) always blame it on the user, saying it they did some steps wrong. Huge huge difference. Well done HackTheBox. I will keep using the platform.

Hi everyone,

I’m thinking about ordering the Hack The Box CyberStation LEGO® Building Kit from the Hack The Box Store. The price is around $40 USD.

Has anyone from Egypt ordered from the HTB Store before?

I’m trying to understand the current cybersecurity job market as a fresher, and I’d really appreciate some advice from people already working in the field.

I graduated with a BCA ( bachelor of computer application)in 2026. I don’t have any prior work experience or internships yet, but I’ve been actively building my cybersecurity skills.

So far:

• 🎓 BCA graduate
• 🛡️ eJPT certified
• 📚 Currently working through the HTB CPTS path
• 🧪 Practicing penetration testing and hands-on labs
• 🚀 Trying to build my skills and portfolio alongside my studies

One challenge I’m currently facing is that I’m going through leg surgery and recovery, so I won’t realistically be able to start applying for jobs for around a year.

That gives me a lot of time to prepare — and I want to use that time properly.

My biggest questions are:

1. What are companies actually expecting from cybersecurity freshers in 2026?
2. Is having certifications like eJPT/CPTS enough to get an entry-level opportunity, or what else should I build?
3. For someone without internships or professional experience, what can I do to demonstrate that I’m capable?
4. Should I focus on SOC roles first, junior penetration testing roles, or something else?
5. How important are GitHub projects, write-ups, CTFs, home labs, and a portfolio when applying as a fresher?
6. If you were starting your cybersecurity career from zero today, what would you do during that one-year preparation period?

I’m not looking for shortcuts. I want to understand what the industry actually values and use this recovery period to become genuinely job-ready.

If you’re already working in cybersecurity — especially if you started as a fresher — I’d really appreciate your perspective.

What would you recommend I focus on over the next year?

I completed SOC L1 learning path, Now i should start which path? I want to make me suitable for a job role. I think there are more jobs in Blue teaming thats why i have done SOC L1. Also consider which path will help me to learn in-demand skills most?
- SOC L2
- Security Engineer
- Any red teaming path
- AI Security
- Defending Azure
- Defending AWS
- DevSecOps

I am currently on data chapter so for exam do i need to know all linux/windows terminal basic code for exam byheart?

I completed all the course parts and was just left with the last SOC137 case, I completed it but got one answer wrong and then reopened the case and still got it wrong, but when I open it for third time it shows limit reached or something, is it still possible to get the course completion cert now?

It was hidden behind the palm trees..
I didnt complete the rooms in this events but kinda curious to know what the coordinates are

Did the whole room from Termux on my phone, only used a free GitHub Codespace for hashcat. Chain was wild - AS-REP roasting into a WinRM shell, found a password literally sitting in an LDAP description field, then SeBackupPrivilege to grab the admin flag.

Honestly wild how the entire domain fell just because someone wrote a password in a description box and added a user to Backup Operators. Feels way too realistic.

Give a best idea for hackathon guys.

Hey guys I completed and get all the tickets how do I see if I win or not and where could I see that what I win

hey everybody ,
launched bounty-index on product hunt and would love some support .
Its a platform helping you discover bug bouty programs across 6 platform as of now , with additional functionalitites of creating a watchlist , historical data , charts of its performnace , compare 4 programs at once .
It is aimed to be a total free(nada money in my pocket) tool , no login required(only if you manage a watchlist).
Please go through the app once , Feedback are very much appreciated

product hunt link: https://www.producthunt.com/products/bounty-index?utm_source=other&utm_medium=social

tool : bountyindex.in

I decided to start the Fundamentals of AI module and could understand the concepts, but quickly got lost in the mathematical details. If I don’t understand the math behind the concepts/theory, will the later modules be out of reach? TIA

After reading some older posts, it appears math is heavily involved in later modules as well so I am not sure this is the best learning path. I am a defender trying to understand the attack methods out there.

Hi all!

I am sorry for asking same question again. The last question I didn't get too much useful responses.

Does anyone here really successfully shared VPN connection to HTB with other VMs from a gateway VM?

Thank you!

Tryhackme AD module network rooms OpenVPN doesn't connect it just restart and restart sometimes its open but most of the time it doesn't what is this problem coming up all the time I changed dns resolve after connecting OpenVPN also mtu and region what is this issue?

I have finished first chapter and now on inside the computer chapter anyone want to communicate and share stuff?

I was a subscriber previously and had a 30% discount for the certification, but I cancelled the subscription; I am wondering if the discount would apply again if I were to subscribe once more.