Skip to main content

​
Getting the most out of it

​
Finding a machine

  • Cmd+K (or Ctrl+K) opens the search bar. Works by name, skill (kerberoasting, shellshock), and operating system.
  • The top tabs filter by OS. Inside each, difficulties are sorted Easy → Insane.

​
How to pick a writeup

Writeups are sorted by language and author:
  1. 🇪🇸 ES — S4vitar, El Pingüino de Mario.
  2. 🇬🇧 EN — 0xdf (deep written walkthroughs), IppSec (step-by-step videos).
If you’re learning the technique from scratch, video tends to win (S4vitar or IppSec). If you need to re-read a specific command, 0xdf’s prose is unbeatable. This isn’t just a machine index — it’s a complete learning system. If you’re starting from zero, this is the optimal order:
1

1. Theory resources

Read Learning resources and pick your platform: PortSwigger Academy (web) → TryHackMe (structured paths) → TCM PEH (professional reporting) → OWASP (reference).
2

2. Tactical glossary

Before touching a machine, open the glossary and find the technique you want to learn. Each entry has Trench / Kill chain / Defensive footprint / False friend / Remediation. Without knowing what an LFI or Kerberoasting is, attacking a machine is roulette.
3

3. Professional methodology

Read Methodology — PTES phases, SMB/AD/Web decision trees, the stopwatch rule, and exploit chaining. Without this you solve machines but you don’t audit.
4

4. Combat (HTB)

Follow the OSCP Roadmap — 30 curated machines in 4 blocks (fundamentals, AD, heavy web, Linux privesc). Includes 2024 OSCP+ changes.
5

5. Report your work

For each completed machine, write the report following the Report template. The 4 professional pages (executive, technical, escalation, remediation) — this is what separates junior CV from senior.
6

6. Advanced specialization

When OSCP no longer scares you: AD CS · Certipy, Cloud Pentest, LLM Security, Modern Red Team, Bug Bounty. Each page with 500+ lines of technical content updated 2024-2026.

​
Quick references

Tactical glossary

100+ terms with fixed format, indexed by block

Methodology

PTES, decision trees, MITRE

Report template

The 4 pages clients pay for

​
Quality policy

These are the rules the pipeline enforces. If you think an author is missing, open a PR against scripts/config.py:
Only URLs whose domain is declared in scripts/config.py get imported. Anything else is dropped even if a discovery step found it.
Before generating a page, every URL receives a HEAD (or a streaming GET for HEAD-hostile hosts like YouTube). Only URLs returning 2xx or a redirect into a 2xx are kept.
We do not copy text or screenshots. Pages list links and metadata. This is intentional: copyright belongs to the author.

​
Local search note

If you see “Login into CLI to enable search” when pressing Cmd+K, it’s a Mintlify warning, not a hub bug. Local indexing requires authenticating with their CLI:
In production (Mintlify-hosted) search works without login. Locally you can ignore the banner and use the side navigation. If a writeup stopped working but the pipeline hasn’t caught it yet, open an issue with the machine name. The weekly regeneration will clean it up anyway, but earlier the better.