Welcome to my HackTheBox writeups repository.
This repository contains my personal notes, solutions, methodologies, and learning journey while solving machines, challenges, and Sherlocks on HackTheBox.
The goal of this repository is simple:
- Learn cybersecurity concepts through hands-on practice
- Improve penetration testing and problem-solving skills
- Keep track of my progress
- Document useful commands, techniques, and methodologies
- Build a consistent cybersecurity learning habit
These writeups are mainly written for myself, so explanations are kept simple, practical, and focused on what I learn from each machine, challenge, or investigation.
.
├── Challenges/
│
├── Machines/
│ ├── 01-Easy/
│ │ └── Cap.md
│ │ └── ...
│ ├── 02-Medium/
│ ├── 03-Hard/
│ └── 04-Insane/
│
├── Sherlocks/
│
└── README.md
The repository is organized into different HackTheBox categories.
HTB machines are organized according to their difficulty:
- Easy
- Medium
- Hard
- Insane
Machine writeups may include:
- Reconnaissance
- Enumeration
- Service discovery
- Vulnerability identification
- Initial access
- Exploitation
- Lateral movement
- Privilege escalation
- Post-exploitation
HackTheBox challenges are organized according to their difficulty:
- Very Easy
- Easy
- Medium
- Hard
- Insane
Challenge writeups may cover areas such as:
- AI/ML
- Blockchain
- Coding
- Crypto
- Forensics
- GamePwn
- Hardware
- ICS
- Misc
- Mobile
- OSINT
- Pwn
- Quantum
- Reversing
- Satellite
- Secure Coding
- Web
HTB sherlocks are organized according to their difficulty:
- Very Easy
- Easy
- Medium
- Hard
- Insane
Sherlocks are investigation-based challenges focused on defensive security, digital forensics, incident response, and analyzing security incidents.
Sherlock writeups may include:
- Incident investigation
- Log analysis
- Network analysis
- Digital forensics
- Malware analysis
- Threat hunting
- Timeline analysis
- Indicators of compromise
- Improve CTF skills
- Build a strong foundation in penetration testing
- Improve Linux enumeration skills
- Improve Windows enumeration skills
- Learn web application security
- Practice privilege escalation techniques
- Improve Active Directory skills
- Understand common vulnerabilities and security misconfigurations
- Improve password attack techniques
- Become more comfortable with security tools
- Improve scripting and automation skills
- Develop better problem-solving methodologies
- Learn to approach unfamiliar systems methodically
- Improve digital forensics and investigation skills
- Stay consistent with cybersecurity learning and documentation
Throughout these machines, challenges, and Sherlocks, I aim to improve my knowledge and practical skills in:
- Network Enumeration
- Service Enumeration
- Web Application Security
- Linux Privilege Escalation
- Windows Privilege Escalation
- Active Directory
- Authentication Attacks
- Password Attacks
- Cryptography
- Reverse Engineering
- Binary Exploitation
- OSINT
- Vulnerability Research
- Scripting and Automation
- Post-Exploitation
- Lateral Movement
- Security Misconfigurations
- Digital Forensics
- Incident Response
- Threat Hunting
- Malware Analysis
This repository will grow as I continue solving HackTheBox machines, challenges, and Sherlocks.
The purpose of this repository is not only to collect solutions, but also to document the process and understand why each technique works.
Each writeup represents another opportunity to improve my methodology, technical knowledge, and problem-solving skills.
All content in this repository is for educational purposes only.
These writeups are based on legal cybersecurity training environments and challenges provided by HackTheBox.
Do not use the techniques, commands, scripts, exploits, or information documented in this repository against systems that you do not own or have explicit permission to test.
Always follow applicable laws, regulations, and the rules of the platform or environment being tested.
The purpose of this repository is to document the journey, not just the answers.
Understanding how to enumerate a target, identify weaknesses, exploit vulnerabilities, escalate privileges, and investigate incidents is more important than simply obtaining a flag.