MacOS Fundamentals

Fundamental

8 Sections

Reward: +10

Your first stop in Hack The Box Academy to become acquainted with the platform, its features, and its learning process.

Fundamental

20 Sections

Reward: +10

The learning process is one of the essential and most important components that is often overlooked. This module does not teach you techniques to learn but describes the process of learning adapted to the field of information security. You will learn to understand how and when we learn best and increase and improve your learning efficiency greatly.

Fundamental

9 Sections

Reward: +10

This module covers topics that will help us be better prepared before conducting penetration tests. Preparations before a penetration test can often take a lot of time and effort, and this module shows how to prepare efficiently.

Introduction to Windows Command Line

Fundamental

14 Sections

Reward: +10

This module covers the fundamentals required to work comfortably with the Windows operating system.

Easy

23 Sections

Reward: +10

As administrators and Pentesters, we may not always be able to utilize a graphical user interface for the actions we need to perform. Introduction to Windows Command Line aims to introduce students to the wide range of uses for Command Prompt and PowerShell within a Windows environment. We will cover basic usage of both key executables for administration, useful PowerShell cmdlets and modules, and different ways to leverage these tools to our benefit.

Introduction to Bash Scripting

Fundamental

30 Sections

Reward: +10

This module covers the fundamentals required to work comfortably with the Linux operating system and shell.

Easy

10 Sections

Reward: +10

This module covers the basics needed for working with Bash scripts to automate tasks on Linux systems. A strong grasp of Bash is a fundamental skill for anyone working in a technical information security role. Through the power of automation, we can unlock the Linux operating system's full potential and efficiently perform habitual tasks.

Introduction to Networking

Fundamental

11 Sections

Reward: +10

This module covers the fundamentals required to work comfortably within the macOS operating system and shell.

Fundamental

21 Sections

Reward: +10

As an information security professional, a firm grasp of networking fundamentals and the required components is necessary. Without a strong foundation in networking, it will be tough to progress in any area of information security. Understanding how a network is structured and how the communication between the individual hosts and servers takes place using the various protocols allows us to understand the entire network structure and its network traffic in detail and how different communication standards are handled. This knowledge is essential to create our tools and to interact with the protocols.

Introduction to Active Directory

Fundamental

16 Sections

Reward: +10

Active Directory (AD) is present in the majority of corporate environments. Due to its many features and complexity, it presents a vast attack surface. To be successful as penetration testers and information security professionals, we must have a firm understanding of Active Directory fundamentals, AD structures, functionality, common AD flaws, misconfigurations, and defensive measures.

Introduction to Web Applications

Fundamental

17 Sections

Reward: +10

In the Introduction to Web Applications module, you will learn all of the basics of how web applications work and begin to look at them from an information security perspective.

Web Requests

Fundamental

8 Sections

Reward: +10

This module introduces the topic of HTTP web requests and how different web applications utilize them to communicate with their backends.

Coltens Path

Modules to improve Web Application Penetration Testing Skills

Medium

259 Sections

Required: 970

Reward: +250

17 Modules included

Fundamental

30 Sections

Reward: +10

This module covers the fundamentals required to work comfortably with the Linux operating system and shell.

Fundamental

14 Sections

Reward: +10

This module covers the fundamentals required to work comfortably with the Windows operating system.

Introduction to Web Applications

Fundamental

11 Sections

Reward: +10

This module covers the fundamentals required to work comfortably within the macOS operating system and shell.

Fundamental

17 Sections

Reward: +10

In the Introduction to Web Applications module, you will learn all of the basics of how web applications work and begin to look at them from an information security perspective.

Web Requests

Fundamental

8 Sections

Reward: +10

This module introduces the topic of HTTP web requests and how different web applications utilize them to communicate with their backends.

Introduction to Windows Command Line

Easy

23 Sections

Reward: +10

Shells & Payloads

Medium

17 Sections

Reward: +10

Gain the knowledge and skills to identify and use shells & payloads to establish a foothold on vulnerable Windows & Linux systems. This module utilizes a fictitious scenario where the learner will place themselves in the perspective of a sysadmin trying out for a position on CAT5 Security's network penetration testing team.

Broken Authentication

Medium

14 Sections

Reward: +20

Authentication is probably the most straightforward and prevalent measure used to secure access to resources, and it's the first line of defense against unauthorized access. Broken authentication is listed as #7 on the 2021 OWASP Top 10 Web Application Security Risks, falling under the broader category of Identification and Authentication failures. A vulnerability or misconfiguration at the authentication stage can impact an application's overall security.

Cross-Site Scripting (XSS)

Easy

10 Sections

Reward: +20

Cross-Site Scripting (XSS) vulnerabilities are among the most common web application vulnerabilities. An XSS vulnerability may allow an attacker to execute arbitrary JavaScript code within the target's browser and result in complete web application compromise if chained together with other vulnerabilities. This module will teach you how to identify XSS vulnerabilities and exploit them.

Command Injections

Medium

12 Sections

Reward: +20

Command injection vulnerabilities can be leveraged to compromise a hosting server and its entire network. This module will teach you how to identify and exploit command injection vulnerabilities and how to use various filter bypassing techniques to avoid security mitigations.

File Inclusion

Medium

11 Sections

Reward: +10

File Inclusion is a common web application vulnerability, which can be easily overlooked as part of a web application's functionality.

SQL Injection Fundamentals

Medium

17 Sections

Reward: +10

Databases are an important part of web application infrastructure and SQL (Structured Query Language) to store, retrieve, and manipulate information stored in them. SQL injection is a code injection technique used to take advantage of coding vulnerabilities and inject SQL queries via an application to bypass authentication, retrieve data from the back-end database, or achieve code execution on the underlying server.

Web Attacks

Medium

18 Sections

Reward: +20

This module covers three common web vulnerabilities, HTTP Verb Tampering, IDOR, and XXE, each of which can have a significant impact on a company's systems. We will cover how to identify, exploit, and prevent each of them through various methods.

File Upload Attacks

Medium

11 Sections

Reward: +20

Arbitrary file uploads are among the most critical web vulnerabilities. These flaws enable attackers to upload malicious files, execute arbitrary commands on the back-end server, and even take control over the entire server and all web applications hosted on it and potentially gain access to sensitive data or cause a service disruption.

Server-side Attacks

Medium

19 Sections

Reward: +20

A backend that handles user-supplied input insecurely can lead to devastating security vulnerabilities such as sensitive information disclosure and remote code execution. This module covers how to identify and exploit server-side bugs, including Server-Side Request Forgery (SSRF), Server-Side Template Injection (SSTI), and Server-Side Includes (SSI) injection attacks.

Session Security

Medium

14 Sections

Reward: +20

Maintaining and keeping track of a user's session is an integral part of web applications. It is an area that requires extensive testing to ensure it is set up robustly and securely. This module covers the most common attacks and vulnerabilities that can affect web application sessions, such as Session Hijacking, Session Fixation, Cross-Site Request Forgery, Cross-Site Scripting, and Open Redirects.

Web Service & API Attacks

Medium

13 Sections

Reward: +20

Web services and APIs are frequently exposed to provide certain functionalities in a programmatic way between heterogeneous devices and software components. Both web services and APIs can assist in integrating different applications or facilitate separation within a given application. This module covers how to identify the functionality a web service or API offers and exploit any security-related inefficiencies.

Intro and OS Fundamentals

This path is an introduction to the Hack the Box Academy and Operating Systems Fundamentals.

Easy

115 Sections

Required: 70

Reward: +70

7 Modules included

Fundamental

8 Sections

Reward: +10

Your first stop in Hack The Box Academy to become acquainted with the platform, its features, and its learning process.

Fundamental

20 Sections

Reward: +10

Fundamental

30 Sections

Reward: +10

This module covers the fundamentals required to work comfortably with the Linux operating system and shell.

Fundamental

14 Sections

Reward: +10

This module covers the fundamentals required to work comfortably with the Windows operating system.

Fundamental

11 Sections

Reward: +10

This module covers the fundamentals required to work comfortably within the macOS operating system and shell.

Getting Started

Fundamental

23 Sections

Reward: +10

This module covers the fundamentals of penetration testing and an introduction to Hack The Box.

Fundamental

9 Sections

Reward: +10

SOC Security Fundamentals

This path amalgamates fundamental skills from built-in HTB academy paths

Easy

277 Sections

Required: 720

Reward: +240

20 Modules included

Fundamental

8 Sections

Reward: +10

Your first stop in Hack The Box Academy to become acquainted with the platform, its features, and its learning process.

Fundamental

20 Sections

Reward: +10

Incident Handling Process

Fundamental

9 Sections

Reward: +10

Fundamental

9 Sections

Reward: +10

Security Incident handling has become a vital part of each organization's defensive strategy, as attacks constantly evolve and successful compromises are becoming a daily occurrence. In this module, we will review the process of handling an incident from the very early stage of detecting a suspicious event, to confirming a compromise and responding to it.

Documentation & Reporting

Easy

8 Sections

Reward: +20

Proper documentation is paramount during any engagement. The end goal of a technical assessment is the report deliverable which will often be presented to a broad audience within the target organization. We must take detailed notes and be very organized in our documentation, which will help us in the event of an incident during the assessment. This will also help ensure that our reports contain enough detail to illustrate the impact of our findings properly.

Security Monitoring & SIEM Fundamentals

Easy

11 Sections

Reward: +20

This module provides a concise yet comprehensive overview of Security Information and Event Management (SIEM) and the Elastic Stack. It demystifies the essential workings of a Security Operation Center (SOC), explores the application of the MITRE ATT&CK framework within SOCs, and introduces SIEM (KQL) query development. With a focus on practical skills, students will learn how to develop SIEM use cases and visualizations using the Elastic Stack.

Fundamental

30 Sections

Reward: +10

This module covers the fundamentals required to work comfortably with the Linux operating system and shell.

Fundamental

14 Sections

Reward: +10

This module covers the fundamentals required to work comfortably with the Windows operating system.

Introduction to Windows Command Line

Fundamental

11 Sections

Reward: +10

This module covers the fundamentals required to work comfortably within the macOS operating system and shell.

Easy

23 Sections

Reward: +10

Introduction to Bash Scripting

Easy

10 Sections

Reward: +10

Introduction to Networking

Fundamental

21 Sections

Reward: +10

Introduction to Web Applications

Fundamental

17 Sections

Reward: +10

In the Introduction to Web Applications module, you will learn all of the basics of how web applications work and begin to look at them from an information security perspective.

Introduction to Python 3

Easy

14 Sections

Reward: +10

Automating tedious or otherwise impossible tasks is highly valued during both penetration testing engagements and everyday life. Introduction to Python 3 aims to introduce the student to the world of scripting with Python 3 and covers the essential building blocks needed for a beginner to understand programming. Some advanced topics are also covered for the more experienced student. In a guided fashion and starting soft, the final goal of this module is to equip the reader with enough know-how to be able to implement simple yet useful pieces of software.

Introduction to Active Directory

Fundamental

16 Sections

Reward: +10

Web Requests

Fundamental

8 Sections

Reward: +10

This module introduces the topic of HTTP web requests and how different web applications utilize them to communicate with their backends.

JavaScript Deobfuscation

Easy

11 Sections

Reward: +10

This module will take you step-by-step through the fundamentals of JavaScript Deobfuscation until you can deobfuscate basic JavaScript code and understand its purpose.

Windows Event Logs & Finding Evil

Mini-Module

Medium

6 Sections

Reward: +20

This module covers the exploration of Windows Event Logs and their significance in uncovering suspicious activities. Throughout the course, we delve into the anatomy of Windows Event Logs and highlight the logs that hold the most valuable information for investigations. The module also focuses on utilizing Sysmon and Event Logs for detecting and analyzing malicious behavior. Additionally, we delve into Event Tracing for Windows (ETW), explaining its architecture and components, and provide ETW-based detection examples. To streamline the analysis process, we introduce the powerful Get-WinEvent cmdlet.

Intro to Network Traffic Analysis

Medium

15 Sections

Reward: +10

Network traffic analysis is used by security teams to monitor network activity and look for anomalies that could indicate security and operational issues. Offensive security practitioners can use network traffic analysis to search for sensitive data such as credentials, hidden applications, reachable network segments, or other potentially sensitive information "on the wire." Network traffic analysis has many uses for attackers and defenders alike.

Windows Attacks & Defense

Medium

16 Sections

Reward: +20

Microsoft Active Directory (AD) has been, for the past 20+ years, the leading enterprise domain management suite, providing identity and access management, centralized domain administration, authentication, and much more. Throughout those years, the more integrated our applications and data have become with AD, the more exposed to a large-scale compromise we have become. In this module, we will walk through the most commonly abused and fruitful attacks against Active Directory environments that allow threat actors to perform horizontal and vertical privilege escalations in addition to lateral movement. One of the module's core goals is to showcase prevention and detection methods against the covered Active Directory attacks.

Operating System Fundamentals

To succeed in information security, we must have a deep understanding of the Windows and Linux operating systems and be comfortable navigating the command line on both as a "power user." Much of our time in any role, but especially penetration testing, is spent in a Linux shell, Windows cmd or PowerShell console, so we must have the skills to navigate both types of operating systems with ease, manage system services, install applications, manage permissions, and harden the systems we work from in accordance with security best practices.

Easy

55 Sections

Required: 30

Reward: +30

3 Modules included

Fundamental

30 Sections

Reward: +10

This module covers the fundamentals required to work comfortably with the Linux operating system and shell.

Fundamental

14 Sections

Reward: +10

This module covers the fundamentals required to work comfortably with the Windows operating system.

Fundamental

11 Sections

Reward: +10

This module covers the fundamentals required to work comfortably within the macOS operating system and shell.

Especialista de Riesgos de Ingenieria

Plan de capacitación gestión 2024

Medium

656 Sections

Required: 6920

Reward: +1480

44 Modules included

Fundamental

20 Sections

Reward: +10

Fundamental

8 Sections

Reward: +10

Your first stop in Hack The Box Academy to become acquainted with the platform, its features, and its learning process.

Getting Started

Fundamental

23 Sections

Reward: +10

This module covers the fundamentals of penetration testing and an introduction to Hack The Box.

Introduction to Networking

Fundamental

9 Sections

Reward: +10

Fundamental

21 Sections

Reward: +10

Fundamental

30 Sections

Reward: +10

This module covers the fundamentals required to work comfortably with the Linux operating system and shell.

Introduction to Active Directory

Fundamental

14 Sections

Reward: +10

This module covers the fundamentals required to work comfortably with the Windows operating system.

Fundamental

16 Sections

Reward: +10