Getting Started with Hack The Box

Key Takeaways

welcome back to another video If I had the chance to write down a plan to break into hack the Box before my memory was suddenly erased then this is what I would come up with hack the box is of course a tough but rewarding platform but if you're willing to put in the work take the right approach then it's definitely worthwhile on top of a methodology I'll also be sharing which boxes I think you'll get the most out of when you're just starting out and some key resources that you'll need are along the way cyber attacks that leverage weak or stolen passwords credentials and secrets are the world's most pervasive cyber security issue and that's why I trust keeper keeper Security's Next Generation privileged access management solution delivers Enterprise grade password secrets and privileged connection management all in one unified platform unlike cpam Solutions keeper is fast and easy to deploy agentless and clientless and has no implementation fees plus keeper is fed ramp authorized you can start your 14-day free trial at keeper. TCM and of course there is a link in the description below as always if you enjoyed the video don't forget to like And subscribe and let's dive in first up we're going to start with what you need to know and of course when you start out with any kind of CTF challenge you're probably going to feel a little overwhelmed so let's make a pre CF or or preck the Box checklist and talk about the relevant resources that we can use to take these off of course we need a stable hacking environment so you can go ahead and download VMware or virtual box install KY Linux and make sure that you have a stable working environment to get started with I don't really recommend parrot as it's just not as stable and I've had some issues with it in the past but of course it's 100% your choice if you need a step-by-step guide on how to set up a VM then you can check out this video here and Heath will walk you through the entire process next we need a good way to take notes and personally I use obsidian and once again there's a video here on the best note keeping apps so feel free to check that out once again it's your choice use the application that clicks with you moving on to our next item we'll also need a methodology or at least a thought process to follow to stop getting lost and falling into every single rabbit hole and this will develop over time but if you use the study approach that I outline in the next section then this will be a good starting point for you we also need knowledge on how to use key tools like nmap and how to find and use exploits how to catch shells etc etc and finally we need some good resources to explore common vulnerabilities and attack paths like hack tricks and payloads or the thing access to writeups that are going to help us study effectively is also really important and for hack the Box you can't go wrong with IC and the Beyond root blogs by 0xdf so now we've got the foundations down how do we progress from here I think that there are three key components that we should aim for first we want to practice efficiently and that means setting achievable goals as well as using an approach that helps us continually move forwards ideally you'll have at least an hour a day to dedicate to your hack the Box practice so for your first five boxes I recommend following the IPC walkthroughs and solving it at the same time make sure that you run all of the tools read all of the output update your notes and each one should take about an hour so let's say if we do one box a day for 5 days and the boxes I suggest you start with are lame active Grandpa shocker and swag sharp they'll give you a nice introduction to to Common Services exploits and are generally just well-made fun boxes to solve now there is an optional path here before you start to do guided boxes hack the box has a starting point path so if you prefer you can follow that and once again try to tick off one section per day and keep notes along the way I've never done this path as it didn't exist when I started out doing hack the box and I'm also a bit of a fan of self-guided learning as it helps me solidify and recall information from the effort that I've put in but if you have done it then let us know down in the comments below and share your experience so now we've got our five boxes out of the way you're going to start seeing some similarities you'll know how to scan and you'll also have been introduced to useful tools and scripts so we're going to slow down just a little bit but actually start trying to solve things ourselves we'll attempt to dedicate about an hour to to each flag so go ahead and set yourself a timer for 30 to 40 minutes try the things that you've learned so far Google things that confuse you and if you don't manage to get the user or root flag spend the rest of the time once again following the right up and updating your notes this balance of trying things yourself learning new things and also learning where you went wrong is going to help you keep building on your Knowledge and Skills but also start developing practical skills that you'll also need to progress I've got 10 more boxes for you and if you dedicate an hour to each flag so Monday use a flag on box one Tuesday root on box one Wednesday use a flag on box two Thursday root on box two etc etc it'll take you about 20 hours or days to get through these and I think that's a manageable amount of work for most people and once you've done that you should be feeling a little bit more confident and can start working through the rest of the retired easy boxes and maybe even starting some medium boxes too I'd recommend getting through a bunch of these and then maybe start to take a look at the live machines now we have our goals and our schedule out of the way next what we want to do is find a group of like-minded people to help you stay motivated and of course push you to learn more you can find study groups and teams probably on every single security or hacking focused Discord server and of course the CM Discord there are people sitting in the voice chat every day studying or working on things like hack the box so of course drop in and get involved ask around and get to know people and finally just a reminder this is something that we always talk about and is key to your success that is consistency you're not going to get good overnight and generally speaking 10 1hour sessions is better than one 10hour session but a few months down the line what will happen is is you'll pop a shell with ease and then you'll suddenly realize how far you've progressed and it'll be a great feeling I promise you and finally before we wrap up we need to talk about having a game plan I've become increasingly supportive of this idea since most times when I get stuck or end up in a rabbit hole it usually ends with ah I forgot to check that or I didn't run any UDP scans or something along those lines the point is if you want to be successful you need to be thorough and as human beings we tend to forget things and make regular oversights your game plan will be based on your notes and help keep you on track it could be as simple as a checklist that you use going into every box or it could be a mind map or something a little bit more detailed more on the lines of hack tricks and over time you'll add new things to it like new commands or techniques or things to check for for hack the box I recommend you have a couple of different lists and at the very least one for initial enumeration a web checklist and a pesque checklist and these should be constantly evolved and adapted to suit your methodology and style and that's it for this video and I really hope this video serves as a good starting point for a long fun and sometimes frustrating journey of hacking and CTF if you have any questions then of course let us know down in the comments below and of course you can catch us on live stream every Tuesday and Wednesday catch you next time