New here?
Start with this.

It's a day-by-day plan for one HTB certification. Every module in the cert's job-role path is split into daily tasks, in the order you should study them, with practice, review days and exam prep mixed in. You check tasks off as you go, and the dashboard shows how far along you are and whether you're on pace.

Each tracker also has a Resource Library (videos, exam reviews, notes, tools and tips from people who passed) and an About tab explaining how the cert and exam work.

Every cert has its own page on this site with two things on it: the tracker and a matching prep vault for your notes (see the next question).

It's a ready-made Obsidian vault for one cert, and it's the notes half of the kit. You'll find it on each cert's page next to the tracker. Inside:

• A Methodology folder with ten blank, numbered phases. You rename them to the steps of your own workflow and fill them in as you learn.
• A note for every Academy module in the cert's path, in course order, ready for your commands and screenshots.
• Links to community cheat sheets for that cert, plus reporting prep: the cert's SysReptor template and the reporting module.

To use one, download the zip from the cert's page, unzip it, and in Obsidian choose Open folder as vault. It only uses Obsidian's built-in features, so you don't need any plugins. If you'd like to look inside first, the View files on GitHub link shows every note.

Once you start writing in it, the vault is yours. Later updates on this site won't touch your copy, so back up the folder like any other (a cloud drive or Git works).

No to both. These are free, independent study aids, not affiliated with or endorsed by Hack The Box. You don't need an account or a sign-up. The HTB content itself (Academy modules, exam vouchers, lab subscriptions) is paid and comes from HTB.

Each tracker offers five timelines, built for roughly 50, 40, 30, 20 or 10 hours of study a week. Pick the one that matches the hours you can really give it, not the hours you wish you had. Bigger certs take more days at the same pace. The CJCA, for example, runs from about 25 days at 50 hours a week to about 130 days at 10.

You can switch later without losing anything. Your checked tasks and notes stay attached to the tasks themselves, so they move with you to the new timeline.

They come from Hack The Box. Every module in HTB Academy shows an estimated completion time on its cert's path page, and the trackers use those official numbers. Each module's hours are spread across its days by section, and the timelines divide the path's total hours by your weekly hours.

Treat them as a minimum. Many learners find a module takes longer than HTB's estimate, especially when you're new to the topic, take thorough notes, or get stuck on a skills assessment. That's normal and doesn't mean you're slow.

If you keep running over, the pace box will show you're behind. Switch to a longer timeline. Your progress carries over, and it's better to plan for your real pace than to fight the calendar.

Everyone does. The pace box on the dashboard tells you whether you're ahead, on pace or behind, based on your start date. If you're behind you can:

• Use the catch-up days built into the plan.
• Switch to a longer timeline. Your progress carries over.
• Change your start date to give yourself a fresh baseline.

The plan is there to keep you moving. Nobody's grading you on it.

In your browser, on your device. Nothing is sent anywhere. That has a few consequences worth knowing:

• Progress on your computer won't show up on your phone or on another browser.
• Clearing your browser's site data (or cookies and site data) erases it.
• Private or incognito windows forget everything when you close them.

That's why the Export backup button exists. See the next question.

Click Export backup in the tracker. It downloads a small file named like cjca-tracker-backup.json with your start date, timeline, checked tasks and notes. On the other computer, open the same tracker, click Import and choose that file.

Export one every week or so and keep it somewhere safe, like a cloud drive or your notes folder. If you ever clear your browser, importing it puts you right back where you were.

Either works. Opening a tracker on this site is the quickest way to start. The Download .html button on each cert's page saves the tracker as a single HTML file that runs offline in any browser.

One catch: the website and a downloaded file keep separate progress, because your browser treats them as different places. Pick one and stick with it, or move between them with Export and Import.

The website version also gets updates, like new resources, as soon as they're published. On rare occasions an update changes a tracker's plan in a way that affects its timeline, and your days might shift along with it. A downloaded file never changes, so it keeps your plan exactly as it was, but it also won't get new resources unless you download it again.

No. Open Already done some modules? in the tracker and tick the modules you've completed. The tracker checks off those tasks for you. If you've passed another HTB cert, the Passed another cert? shortcuts tick every module the two paths share.

Clicking a day's DAY badge also marks that whole day done in one click, which is handy for catching up on days you did but didn't tick.

They tell you what you need to access a practice lab on the main HTB platform (not the Academy). Free means any HTB account can play it. VIP+ means it's retired, and retired machines and challenges need a paid VIP+ subscription. HTB does keep a small, rotating set of retired machines free, so a VIP+ box might be free for a while when you look. Pro Labs need an HTB PRO subscription, which includes 10 of them (Dante, Zephyr and Offshore among them).

Labels can also go out of date. Active machines are free, but when one retires it becomes VIP+, so a box marked Free here might need VIP+ by the time you get to it. HTB's HTB Labs Subscriptions page has the current details for each plan.

None of these are required to pass. They're extra practice.

Use Suggest a resource or Report a problem on GitHub. Both work for the trackers and the prep vaults. You'll need a free GitHub account.

HTB Academy (academy.hackthebox.com) is where the courses live. Its modules teach a topic step by step, with small labs and questions to answer. Certifications are earned through the Academy.

HTB Labs, the main hackthebox.com platform, is where the "boxes" are: full practice machines you attack without instructions. They're great for practice, but separate from the Academy and billed separately.

A module is one course on one topic, like "Linux Fundamentals" or "Network Enumeration with Nmap". Each module is split into sections, short lessons that often end with a question you answer from a lab.

A job-role path is HTB's ordered list of modules for a role. Each certification has one, and you have to finish the whole path before the exam unlocks. The About tab in each tracker says how big that cert's path is.

The last section of many modules. Instead of step-by-step questions, you get a scenario and have to use what the module taught to solve it on your own. It's the closest thing to exam practice inside the path. If one feels hard, redo it before the exam. The trackers schedule time for that.

Cubes are the Academy's currency for unlocking modules one at a time. A subscription unlocks modules up to a tier every month instead. The exam is a separate purchase called a voucher, and some annual plans include one. Prices and plans change, so check HTB's own pricing page before you buy.

How many attempts a voucher gives you, and how retakes work, varies by cert. Each tracker's About tab covers it.

A machine (or box) is a computer set up for you to break into legally. A flag is a string of text hidden on it that proves you got in. Usually there's a user flag for getting a foothold and a root flag for taking full control (privilege escalation). Many HTB exams are built from machines like these, so practicing on boxes is good exam prep.

A writeup is someone's walkthrough of how they solved a box. Try the box first, then read a writeup to see what you missed.

An attack box is the Linux machine you work from, loaded with security tools. You have two options:

• Pwnbox is HTB's attack box that runs in your browser: a Parrot Linux desktop with the tools already installed and already on HTB's network. Any paid Academy plan or purchase includes unlimited Pwnbox time, but each session shuts down eventually, so keep your notes outside it. HTB's Introduction to Pwnbox shows how to start one.
• Your own virtual machine running Kali Linux or Parrot OS, inside free software like VirtualBox or VMware Workstation. It takes an hour to set up, but it's yours, it keeps your files, and it has no time limit. HTB's guide to installing Parrot on a VM lists the settings to use, and Kali has its own VirtualBox guide.

Pwnbox is the easiest way to start. Most people move to their own VM before the exam, since exams run for days.

If you're not using Pwnbox, your VM has to join HTB's lab network. In the Academy, open a lab section, choose to connect with VPN, and download the .ovpn file. Then in your VM's terminal:

sudo openvpn ~/Downloads/academy-regular.ovpn

Use whatever name your file actually has. Leave that terminal open while you work. When it says "Initialization Sequence Completed", you're connected, and the lab's target IP should respond. Don't run Pwnbox and your own VPN connection at the same time.

HTB's Connecting to Academy VPN article walks through each step, and Connection Troubleshooting covers the common errors if it won't connect.

Because the exam is a race against the clock, and you need to find a command in seconds, not dig through your whole path. Your notes are also where your report comes from. Take notes on every module from day one: the exact commands that worked and a screenshot of the result.

The popular ones for this kind of study are Obsidian, Joplin, CherryTree and Notion. They all work, and the best one is the one you'll actually keep using. TCM Security's The BEST Notetaking Apps Ranked (9 minutes) compares them with pros and cons for each.

Personally, I use Obsidian. It's free, the notes are plain text files you own, and it handles code blocks and screenshots well. That's why the next answer walks through setting it up.

Obsidian is a free note-taking app. Your notes are plain Markdown text files in a normal folder on your computer, so they're never locked inside an app.

The quickest start is the prep vault for your cert. Install Obsidian, download the vault from the cert's page, unzip it and choose Open folder as vault. It's already set up with the folders, module notes and screenshot settings below. If you'd rather build your own from scratch, here's how:

1. Download it from obsidian.md and install it.
2. Choose Create new vault. A vault is just the folder your notes live in. Name it after the cert, like CJCA.
3. Make a few folders: Modules (one note per module), Field Manual (see below), Screenshots, and Exam.
4. In Settings → Files and links, set the default location for new attachments to your Screenshots folder. Now screenshots you paste land there instead of cluttering everything.
5. Start your first module note. Headings start with #, and commands go in code blocks between two lines of three backticks (```), so they stay copyable.

A simple note for each module is plenty: what the module is about, the commands that worked (with a line on what each does), gotchas, and screenshots. You don't need plugins or themes to start. Plenty of people over-build their Obsidian setup and study less.

Back up the vault folder like any other folder (a cloud drive or Git works).

A short list of commands for a topic with a line on what each does. Most HTB Academy modules come with an official cheat sheet: look for the Cheat Sheet button above the module's table of contents, which opens it as a PDF. The trackers remind you to save each one when you finish a module, and to merge them with your own notes before the exam.

To see what a finished one looks like, zagnox/CPTS-cheatsheet is a popular community cheat sheet that covers nmap, common services, passwords and more. It's built for the CPTS, but a lot of it applies to entry-level certs too. Each prep vault's Home page links the community cheat sheets for its own cert.

A field manual is your personal playbook, organized by what you're trying to do, not by which module taught it. Module notes follow the course. A field manual answers the question you'll actually have mid-exam, like "I found an SMB share, now what?"

Each page covers one technique or service and has:

• A short explanation of when to use it.
• A table of the commands, with what each one does.
• What to look for in the output, plus the next step.

For example, a page called SMB might list how to find shares, connect to them, and what to try if anonymous login works. Build it as you study by copying the commands that worked from your module notes into the right page. By exam day, any technique should be one lookup away. It works for any cert, and it's worth starting with your very first module. The prep vaults leave their Methodology folder blank for this reason, so you can build it your own way.

If you use Obsidian, blue-pho3nix/pentesting_templates_obsidian is a good template to start from. It's a set of Obsidian templates organized the same way, by phase and then one page per service or technique (it even has an SMB page). Its README walks you through setup: copy the templates into your vault, turn on the free Templater community plugin, and insert a template with Alt+E. It was built for CPTS and OSCP prep, so treat it as a structure to copy and fill with the commands you learn in your own path.

HTB exams aren't just about the hands-on part. Every exam ends with a professional report that HTB staff grade, and a weak report can fail you even if you got enough points.

SysReptor is a reporting tool that has official templates for HTB exams. You write your findings in it and it produces a polished PDF. You can run it yourself, or use SysReptor's free cloud for HTB students, explained on their Hack The Box Reporting page. If you use the cloud, export your report when you're done, because inactive accounts are deleted after three months. SysReptor also publishes a sample report for each HTB cert (here's the CJCA one), and every tracker links its cert's sample under Reporting & Exam Prep. Read yours before you start the exam, since it shows the structure and depth HTB expects.

For a walkthrough, Cyber Ryan's CPTS Report Made EASY video covers setting up SysReptor and using the HTB template, and dollarboysushil's report writing guide shows what each section of a finished report looks like. Both use the CPTS, but the process is the same for every HTB cert.

Whatever cert you're taking, do the Documentation & Reporting module from the Penetration Tester path. It's already part of the CPTS path; for other certs you add it yourself. It's built around the CPTS report, so it won't match your cert's report one for one, but the note-taking habits and report tips carry over to every exam.

Practice once before exam day: pick an easy box, solve it, and write a short report about it in SysReptor. Several exam reviews in the Resource Library say the same thing: start writing during the exam, not on the last night.