HackTheBox Guide for Beginners 2026: How to Start and Progress Fast

HackTheBox is where serious penetration testers sharpen their skills. Unlike guided platforms, HTB drops you into a machine and expects you to figure it out — just like a real engagement. That's what makes it valuable, and why it has a reputation for being hard.

This guide shows you how to approach it systematically and progress efficiently.

HTB Academy vs HTB Labs

HackTheBox has two distinct products:

HTB Academy

Structured, guided learning modules. Think video course meets practical lab. Covers:

• Penetration testing methodology
• Active Directory exploitation
• Web application attacks
• Privilege escalation (Linux + Windows)
• Pivoting, tunnelling, port forwarding

Most modules include a free tier with practice machines. Paid tiers unlock more content. Start here if you're new to HTB — Academy teaches you the concepts, Labs let you apply them.

HTB Labs (Main Platform)

Actual hacking challenges:

• Starting Point: Guided beginner machines (tiers 0–2). Questions walk you through the solution.
• Active Machines: Current challenges — no write-ups allowed. Real competition.
• Retired Machines: Older machines with full community write-ups. Excellent for learning methodology.
• Tracks: Curated machine sets (e.g., "OSCP-like", "Active Directory 101")
• Pro Labs: Full enterprise network simulations (Offshore, RastaLabs, Cybernetics). Advanced.

Starting Point: Your First Machines

Starting Point is the best entry into HTB Labs. Machines are designed for beginners and come with guided questions and hints.

Tier 0 (Pure Basics)

Machine	OS	Key Skill
Meow	Linux	Telnet, default credentials
Fawn	Linux	FTP anonymous login
Dancing	Windows	SMB enumeration
Redeemer	Linux	Redis, unauthenticated access

These teach you that misconfiguration and default credentials are real attack surfaces — not just textbook examples.

Tier 1 (Web + Service Enumeration)

Machine	OS	Key Skill
Appointment	Linux	SQL injection login bypass
Sequel	Linux	MySQL unauthenticated access
Crocodile	Linux	FTP + web login
Responder	Windows	LLMNR poisoning, hash capture
Ignition	Linux	Web admin default creds

Tier 2 (Chaining Exploits)

Machines here require combining multiple steps. No longer hand-holding — you research and exploit independently.

Approaching a Machine (Your Methodology)

Every machine follows a pattern. Develop this into muscle memory:

Phase 1: Reconnaissance

# Always start with a full port scan
nmap -sC -sV -oA initial <machine_ip>

# Follow up with all ports if initial scan misses something
nmap -p- --min-rate 5000 -oA allports <machine_ip>

Document every open port, service version, and interesting banner. Full Nmap guide here.

Phase 2: Enumeration

For each service found, enumerate deeply:

• HTTP/HTTPS: Gobuster/ffuf for directories, check robots.txt, view source, look for admin panels
• SMB: enum4linux or smbclient -L //IP
• FTP: Try anonymous login: ftp IP → user: anonymous
• SSH: Note the version, check for known CVEs
• SQL: Try default credentials, look for login bypass

Phase 3: Exploitation

Once you find a vulnerability:

• Search Exploit-DB: searchsploit <service> <version>
• Check Metasploit: search <service>
• Look for public PoCs on GitHub

Phase 4: Privilege Escalation

After getting initial access (usually as a low-privilege user), escalate to root/Administrator. This is where most beginners get stuck — see our dedicated privilege escalation guide.

Phase 5: Flags

• User flag: /home/<username>/user.txt
• Root flag: /root/root.txt (Linux) or C:\Users\Administrator\Desktop\root.txt (Windows)

Best Retired Easy Machines to Practice On

These are free to access with community write-ups available. Work through them in order:

Machine	OS	Why it's important
Lame	Linux	Classic SMB exploit, great intro
Legacy	Windows	MS08-067 — foundational Windows exploit
Blue	Windows	EternalBlue (MS17-010) — understanding this is essential
Jerry	Windows	Tomcat manager default creds, war file upload
Bashed	Linux	Web shell, sudo escalation
Shocker	Linux	Shellshock — great CVE study
Optimum	Windows	Windows kernel exploit chain
Beep	Linux	Multiple attack paths, great for methodology
Devel	Windows	FTP + token impersonation

How to Use Write-ups Without Cheating Yourself

Looking up write-ups for retired machines is legitimate — but do it right:

1. Spend at least 2 hours stuck before reading a write-up
2. Stop reading as soon as you understand the hint — try it yourself
3. After finishing with a write-up, redo the machine from scratch the next day without looking

The goal is to internalise the methodology, not to collect flags.

HTB for OSCP Preparation

The OSCP certification requires compromising 70 points of machines in 24 hours. HTB is the best free preparation:

1. Complete HTB Academy — especially Active Directory and Privilege Escalation modules
2. Work through the TJNull list — a community-maintained list of OSCP-like HTB machines
3. Practice Active Directory attacks — Cascade, Blackfield, Monteverde are excellent
4. Time yourself — simulate exam conditions on unfamiliar machines

HackTheBox vs TryHackMe

	HackTheBox	TryHackMe
Guidance	Minimal	Step-by-step
Difficulty	Intermediate–Advanced	Beginner–Intermediate
Best for	OSCP prep, realistic practice	Learning fundamentals
Community	Competitive	Supportive
Write-ups	Retired machines only	Many rooms have guides

Recommendation: Do TryHackMe Jr Penetration Tester first, then come to HackTheBox. You'll progress much faster with the foundation.

For structured learning alongside HTB, our free Pentevo Academy covers the CEH curriculum with guided video lessons.