ZeroBox

HTB Starting Point Machines: 22 boxes by difficulty

HTB Starting Point is the guided beginner track on Hack The Box, organised into tiers that introduce core services, simple web flaws and first privilege escalations. It is not a certification, but it is the usual entry route before OSCP or CPTS style preparation.

The 22 machines on this page are tagged HTB Starting Point in the ZeroBox catalog and come from HTB. By operating system that is 17 Linux, 5 Windows. These machines are short and forgiving, so they are ideal for building the habit of scanning, enumerating each service and writing down what you learn. Finish a tier, then repeat the box without the guide to check that the process has stuck.

To use the list, start at the easiest group and work upward, spending real time on enumeration before looking at any help. After each box, write down the foothold, the escalation and what you would do faster next time. 14 of these are targets I solved myself, so they link to an attack path summary on this site; the others link to the official room. Once you are comfortable, rehearse under pressure in the exam simulator, and follow the phase-by-phase pentest methodology checklist so you do not skip steps. You can also browse the technique hubs to drill one skill at a time.

Jump to difficulty

HTB Starting Point machine list by difficulty

Very Easy (22)

MachinePlatformOSTags
AppointmentHTBLinuxSQLi, Web Auth Bypass, SQL Injection
ArchetypeHTBWindowsMSSQL, xp_cmdshell, JuicyPotato, PowerShell
BaseHTBLinuxPHP, Type Juggling, File Upload
CrocodileHTBLinuxFTP, Admin Panel, Gobuster
DancingHTBWindowsSMB, Share Enumeration, smbclient
ExplosionHTBWindowsRDP, Remote Desktop, Default Credentials
FawnHTBLinuxFTP, Anonymous Login
IgnitionHTBLinuxhttp, cms, credentials, starting-point
MeowHTBLinuxTelnet, Default Credentials, Recon
PennyworthHTBLinuxJenkins, Groovy, RCE, Default Credentials
RedeemerHTBLinuxRedis, Database, Unauthenticated
SequelHTBLinuxMySQL, MariaDB, Default Credentials
TacticsHTBWindowssmb, administrator, share, starting-point
VaccineHTBLinuxFTP, SQLi, Sudo, Tar Wildcard
BikeHTBLinuxNode.js, SSTI, Handlebars
FunnelHTBLinuxSSH, Port Forwarding, PostgreSQL, Tunneling
GuardHTBLinuxSSH, Hash Cracking, Sudo
IncludedHTBLinuxTFTP, LFI, Local File Inclusion
MarkupHTBWindowsXXE, XML, SSH, Scheduled Task
OopsieHTBLinuxIDOR, SUID
ThreeHTBLinuxAWS, S3, Cloud, Subdomain
UnifiedHTBLinuxLog4j, CVE-2021-44228, UniFi, MongoDB

Track your progress. ZeroBox keeps a Kanban board, notes and checklists for every box, offline in your browser. Open ZeroBox

Related guides

Machines belong to HTB. ZeroBox is not affiliated with the platforms or certification bodies named here.