Looking for a clear, structured way to build the skills you need without the guesswork?

We have revamped our old Tracks and released new ones—our collection of curated paths—to guide you through a structured, hands-on learning experience. These Tracks are designed to address specific focus areas using a combination of the best Machines, Challenges, or Sherlocks.

Whether you want to master Mobile Exploitation or explore emerging fields like ICS/SCADA Security, Tracks provide a clear pathway for tackling key cybersecurity domains and developing real-world skills.

We are introducing a new tab on each content page, featuring curated scenarios that align with similar MITRE ATT&CK techniques.

These recommendations will help you stay on track and pick the best content for your skill progression, ensuring your learning stays aligned with real-world cybersecurity standards.

By consulting these content recommendations, you’ll get:

Start a 14-day business trial FOR FREE →

Boost engagement and enhance cyber performance by offering your team a holistic event experience that blends CTF Challenges with hands-on attack simulations focused on the most common and recent system vulnerabilities and misconfigurations.

As an event manager, you now have the power to select the category (aka Machines) directly from the , enabling you to create dynamic, realistic events that truly challenge your team.

We’ve released our first curated CTF pack that features 10 offensive scenarios, each mirroring real-world vulnerabilities commonly found in enterprise networks.

Designed for security professionals, red teamers, and CTF players, this pack provides essential penetration testing skills, covering areas like network enumeration, web application exploitation, CVE exploits, Active Directory attacks, and Linux and Windows privilege escalation.

With this pack, your team will:

Forensic investigations rely on every piece of evidence — but one powerful log source often goes unnoticed: Windows SmartScreen Debug Event Logs.

Our new Sherlock introduces you to this hidden forensic artifact, helping you track executed applications and detect corporate sabotage.

By solving , you’ll gain real-world experience in:

💡 Learn how to analyze Windows SmartScreen Debug Event Logs with this step-by-step guide by CyberJunkie.

Start a 14-day business trial FOR FREE →

Login to HTB Labs today →

Attackers constantly evolve their techniques to bypass security controls, and process injection is one of their go-to methods for executing malicious code within legitimate processes.

Do you have what it takes to detect and stop them? In this new Academy Module, you will:

Start a 14-day business trial FOR FREE →

Head to HTB Academy and start learning today →

We’ve improved notifications to offer better visibility for both admins and users regarding content requests.

HTB Academy now exclusively uses HTB Account for login and registration, providing a seamless and unified experience across all HTB platforms.

This change enhances security, simplifies access, and ensures better integration within the HTB ecosystem.

Three (3) new exclusive Machines just landed in Dedicated Labs, focusing on phishing, privilege escalation, and CVE exploitation.

Master Phishing and 2FA Bypass by leveraging a reverse proxy as a Man-in-the-Middle attack. If you haven't explored “GoneFishing” yet, start there for a smoother learning experience!

Learn to exploit CVEs in real-world applications like Qdrant (CVE-2024-3829) and LocalAI (CVE-2024-2029) to gain a foothold, escalate privileges, and achieve root access.

Understand how CVE exploitation can impact financial applications by leveraging CVE-2024-36104 to execute unauthenticated remote code execution on Apache OFBiz.

Start a 14-day business trial FOR FREE →

Three (3) new Essentials CTF packs have just dropped, each designed to sharpen your expertise in critical cybersecurity areas.

Our first AI security CTF pack is designed for security professionals and AI engineers to develop expertise in exploiting AI vulnerabilities through prompt injection. With 10 hands-on Challenges, participants will learn to manipulate AI-generated responses, extract sensitive data, and uncover real-world risks in AI-powered systems, strengthening their ability to enhance AI security.

Designed for incident responders and malware analysts, this pack builds core skills in malware analysis, reverse engineering, and threat mitigation. Through 10 new Challenges, participants gain hands-on experience with static and dynamic analysis, cryptographic decryption, and behavioral forensics to enhance threat detection and incident response.

Designed for engineers and technical professionals, this pack introduces 8 coding-based Challenges that build problem-solving skills and structured thinking, making cybersecurity more accessible. By bridging the gap between software engineering and cybersecurity, it prepares teams for real-world security challenges while fostering a seamless transition into security-focused roles.