What are Academy Modules?
Modules serve as standalone courses focused entirely on a single, specific topic.
Subject Focus: Each Module provides dedicated training confined to a specific technical subject, such as Linux Privilege Escalation or Windows Fundamentals.
Cube Costs: Every standalone Module acts as its own discrete unit and requires a specific cost in Cubes to unlock. Your access to these depends on your current tier:
Users on a Free account can unlock individual Modules by purchasing and spending Cubes directly.
Users with an active HTB Academy subscription gain immediate access to specific tier-unlocked Modules included with their plan.
Understanding Sections and Interactive Labs
Every individual Module is further broken down into smaller pieces called Sections to make the information digestible.
Structure of Sections: Sections function like textbook chapters or individual lessons. Each Section covers a separate, discrete part of the broader subject matter. For example, the Linux Fundamentals Module includes distinct Sections for User Management, Package Management, and Navigation.
Interactive Assessment Questions: Many Sections feature interactive components. These components provide live target systems and specific assessment questions so you can safely test your practical skills in a real-world environment.
What are Academy Paths?
Paths are structured role-based learning tracks that group multiple related Modules together into a recommended reading order.
Mastering a Subject: The primary goal of a Path is to guide you through a sequential series of individual Modules so you can completely master a large, complex domain or prepare for a job role.
Example of a Path: The Active Directory Enumeration Path automatically bundles together several distinct Modules that cover different tactical areas of Active Directory environments, guiding you from the basics to advanced exploitation.
Enrolling in Paths and Modules
Enrolling in Paths and Modules on HTB Academy
To begin your educational journey on HTB Academy, you can enroll in a comprehensive Path or start working on individual training Modules directly. There are scores of interactive Modules to choose from on the platform. You can find all available options by navigating directly to the top menu and clicking on the Library tab to see what fits your technical interests.
If you are unsure where to begin your training, the Introduction to Academy and Learning Process Module is a great place to start.
Unlocking an Individual Module
Once you choose a specific training subject, you must unlock it before you can begin working on its contents. Unlocking a specific standalone Module requires a set amount of platform currency known as Cubes.
Step-by-Step Instructions to Unlock a Module:
Open the target workspace: Navigate directly to the Library overview and click on the specific course tile you want to open, such as the Introduction to Deserialization Attacks workspace.
Deduct your Cubes currency: Click on the green action button labeled Unlock Module to automatically deduct the required amount of Cubes from your account balance.
Initialize your lab environment: Verify that the primary green button interface text has changed to read Start Module, then click it to begin your training.
For all Tier 0 Modules, the final amount of currency awarded back to your profile upon completion matches the unlock cost exactly, making these introductory workspaces completely free to complete.
Completing a Module also awards some Cubes back to you. For the Tier 0 Modules, the amount awarded back to you for completing the module is the same as the cost, making these completely free.
Important: Cubes are not instantly granted upon Module completion. Instead, they are awarded to you progressively throughout the Module as you answer questions.
Enrolling in a Structured Job-Role Path
Unsure of what Module to start with? That's okay! Instead, you could enroll in a Path for a guided experience. Enrolling in a Path is just as simple as unlocking a Module.
If you prefer a guided, end-to-end learning path instead of standalone courses, you can choose to enroll in an official HTB Academy Path. Enrolling in an entire tracking Path follows the exact same verification loop as unlocking an individual Module.
Step-by-Step Instructions to Enroll in a Path:
Select your technical track: Click directly on the specific role path card you want to pursue, such as the SOC Analyst learning track workspace.
Initialize the course queue: Locate the interactive button inside the left side panel labeled Enroll Path and click it to bind the track to your profile dashboard.
Once you've enrolled, your chosen path will be displayed on your dashboard under the Currently Enrolled Path section. From here, you will be able to see the individual Modules that make up the Path and start or continue working on it.
Step-by-Step Instructions to Resume or Change a Path:
Resume active progress lines: To pick up exactly where you left off in your training track, locate the primary user panel and click the button labeled Continue.
Switch your active enrollment track: If you want to change your focus to a different career track, navigate back to the paths overview page, select a new role profile, and click Enroll Path. The platform database will automatically unenroll your profile from your old track and substitute it with the new path choices.
Estimated Completion Times for HTB Academy Paths
If you are wondering how long it takes to complete a Module or a Path in HTB Academy, the estimated time varies according to the content.
Whenever you visit a module or path's details within Academy, you will see the estimated time for completion being shown as either Days, Hours, or both.
For example, as you can see, the Penetration Tester Job Role Path, which prepares users for the CPTS Exam, takes users, on average, 42 days and 6 hours to complete:
Please note that HackTheBox calculates each estimated "day" for completion based on an 8-hour study session.
To ensure you do not have to calculate the total number of hours it would take the average user to complete each of HackTheBox's Job Role Paths, we have provided both the standard day/hour estimates and the total estimated hours for each path.
Here is the breakdown of how long each path takes to complete in HTB Academy:
HTB Academy Path | Original Estimate | Total Estimated Hours |
Web Penetration Tester (CWES) | 21 days, 6 hours | 174 hours |
Penetration Tester (CPTS) | 42 days, 6 hours | 342 hours |
SOC Analyst (CDSA) | 23 days, 5 hours | 189 hours |
Senior Web Penetration Tester (CWEE) | 27 days | 216 hours |
Active Directory Penetration Tester (CAPE) | 35 days, 5 hours | 285 hours |
AI Red Teamer (COAE) | 18 days, 4 hours | 148 hours |
Junior Cybersecurity Analyst (CJCA) | 17 days, 3 hours | 139 hours |
Wi-Fi Penetration Tester (CWPE) | 18 days | 144 hours |
Detection Engineering (CDEP) | 75 days | 600 hours |
Please note that these timeframes are averages. It may take you more or less time to complete these paths depending on your personal learning pace and prior experience.
Understanding HTB Academy Module Structure
Every training course on Hack The Box (HTB) Academy is known as a Module. To make learning manageable, each Module is broken down into sequential lessons called Sections. You can easily track your location and view a complete index of these lessons by opening the Table of Contents menu from the content navigation panel.
Lesson Types: Reading vs. Interactive Sandboxes
Sections are split into two specific formats depending on the type of skills being taught:
Theory Lessons (Article Icon): These sections are strictly informational and require reading through text documentation, concepts, and technical examples. They feature an Article icon and do not require live platform lab interaction.
Practical Sandboxes / Workstation (Interactive Icon): These sections feature an Interactive or finger-click icon, meaning you must actively engage with live lab environments to progress. These sections spin up a dedicated Workstation/Pwnbox instance or target system and include specific Assessment Questions at the bottom of the page that you must answer to clear the lesson.
You can view all of the Sections in a Module in the Table of Contents on the right side of the Module's content.
Using our in-built AI-Powered Translations
To support global learning, the platform features built-in AI Translation tools that allow you to convert instructional text into different languages on the fly.
Supported Languages: You can translate your training content into nine different languages: Hindi, Arabic, Spanish, French, Simplified Chinese, Traditional Chinese (HK), Traditional Chinese (Tw), Greek, and Japanese.
Technical Safeguards: To ensure your technical training remains accurate, the translator will never alter terminal commands, URLs, source code blocks, security tool names, or embedded images.
Usage Controls: You can freely switch back and forth between English and your preferred language as many times as you need during an active study session.
The Cheat Sheet
Each course includes a dedicated Cheat Sheet to provide a fast technical reference for syntax and commands related to that specific topic. This reference contains both the explicit commands covered in the course material as well as additional, related commands for real-world practice.
You can locate and access the Cheat Sheet using two different methods on the platform interface:
The Main Navigation Method: Click the Cheat Sheet button located inside the header options panel directly above the Table of Contents menu.
The Lab Assessment Method: Scroll down directly to the Questions panel inside any active Interactive Section to find a secondary quick-access link to the document.
Taking Notes Inside HTB Academy Modules
To help you track your thoughts and document commands, Hack The Box (HTB) Academy includes a built-in note-taking workspace right inside the module interface.
Key Features of the Note-Taking App
The note-taking utility operates under strict account and saving rules to keep your workspace organized:
Module Isolation: Every set of notes is uniquely dedicated to the specific course you are currently viewing. Anything you document is automatically saved and tied exclusively to that single course entry, allowing you to quickly revisit your thoughts whenever you return to the same lesson.
Manual Save Enforcement: To ensure your data is stored permanently in the platform database, you must click the Save Note action button after writing or editing your entries. Any unsaved modifications will be permanently lost if you navigate away from the page.
Quick-Copy Clipboard Utility: You can instantly duplicate your compiled notes by clicking on the built-in Copy utility shortcut, making it simple to paste your notes into local documentation files if needed.
Live Markdown Integration: The workspace fully supports standard Markdown styling tags. You can toggle the Preview Markdown button at any time to review exactly how your formatted text will render before committing your changes.
Supported Markdown Formatting Examples
You can use the following standard syntax parameters inside your notes panel to structure your data cleanly:
Document Headers
Create structural titles by placing a # symbol before your text string:
Plaintext
# Header 1 ## Header 2 ### Header 3 #### Header 4 ##### Header 5 ###### Header 6
Text Emphasis
Apply stylistic emphasis markers to highlight critical terms or variables:
Bold Text: Wrap your text string using double asterisks (
Bold Text).Italic Text: Wrap your text string using single asterisks (
*Italic Text*).
Structured Lists
Organize lists sequentially or into flat bullet points:
Unordered Bullet Items: Place a hyphen before each entry (e.g.,
- Unordered item 1).Ordered Numbered Items: Place a numeral and a period before each entry (e.g.,
1. Ordered item 1).
Blockquotes and Code Syntax Blocks
Isolate technical code strings or instructional highlights:
Blockquotes: Place a greater-than sign before your text sentence (
> This is a blockquote) to indent and highlight quotes.Code Blocks: Enclose multi-line commands or terminal strings using triple backticks accompanied by the language flag (e.g.,
```bash) to enable clean syntax highlighting for your scripts.
You can find more markdown examples here.
Progressing through a Module
Every training course on Hack The Box (HTB) Academy is organized into sequential lessons called Sections. Each Section delivers detailed reading materials, concrete technical explanations, and contextual examples designed to teach you a specific cybersecurity concept or tactic.
Completing Lessons and Tracking Your Progress
To maintain a clean and accurate record of your training data, the platform uses a manual completion verification loop:
Submitting Active Sections: Once you have thoroughly reviewed the course material and completed any included practical exercises, you can log your progress by clicking the lime-green action button labeled Mark Complete & Next.
Automated Redirection: Clicking the completion button automatically saves your work to the cloud database, closes out your current page, and forwards your browser directly to the start of the next lesson.
Visual Status Identifiers: To help you easily keep track of the course sections you have already finished, the system automatically appends a green checkmark icon right next to the lesson title inside your Table of Contents menu index.
Each Section of a Module contains reading material that serves as a lesson on the given topic. You'll want to be sure to read this material carefully, taking the time to make sure you understand it, and doing your own research when necessary.
Interactive Sections and Target Systems
Interactive Sections are the practical portion of Academy Modules. This is where you take the knowledge you've gathered from the reading material and actually apply it.
Sometimes this means you answer an assessment question on the material you've just read. Other times it means you use the Pwnbox instance provided to you under My Workstation to run some commands. Most times, it means you are given the IP address of a target, which you'll then either connect to or attack.
Many Interactive Sections will require you to spawn a Target System. These are systems that have been configured to be enumerated or attacked as part of a lesson. They come in two flavors: Docker Targets and VM Targets.
Docker Targets
Docker Targets deploy lightweight microservices configured for a specific lesson scenario.
Network Structure: Once initialized, the interface exposes an environment address formatting pattern structured as an IP address accompanied by a custom port string (e.g.,
IP:PORT).Scope Constraints: The testing boundaries of a Docker laboratory instance are strictly confined to that single exposed port. Extensive network subnet enumeration beyond the designated port is unnecessary.
Connectivity Rules: Docker labs are routed to be globally accessible over the public internet. This means you do not need an active VPN connection sequence running to connect to or attack a Docker target.
VM Targets
VM Targets are full-scale operating systems, typically used for complex environments like Windows infrastructure or Active Directory networks.
Network Structure: When spawned, the dashboard displays a dedicated standalone internal IP address, such as
10.129.89.137(a private network string).Authentication Provisioning: If the exercise requires authenticated testing, the system will print a set of access credentials alongside the target data, specifying remote access protocols such as SSH, RDP, or WinRM. For example:
SSH to 10.129.89.137 with user "htb-student" and password "HTB_@cademy_stdnt!"Unauthenticated Rules: If no administrative credentials or login methods are populated on your dashboard tile, the lab design expects you to launch an unauthenticated attack path to exploit the target system.
Spawning Target Systems
Practical exercises on Hack The Box (HTB) Academy require you to interact with live environments. These live target instances are deployed and managed through a central interface panel integrated directly into your module workspace
Step-by-Step Instructions to Manage Labs:
Spawn a Target System: Navigate to the lab section and click the bright green button labeled Spawn the target system.
Handle System Stability Issues: If a target host stops responding or crashes during exploitation, click the circular Reset icon on your active instance tile to wipe the sandbox and boot a fresh copy.
Extend or Terminate Reservations: Track your lab session length using the live Time left countdown display. Click the clock button to add more runtime to your laboratory instance, or click the red X button to instantly shut down the machine.
Submitting Answers
Most Interactive Sections feature specific validation checkpoints designed to test your results.
Entering Flags: Once you gather the correct information or crack the system password, enter your text string directly into the text field box and click the Submit button.
Requesting a Nudge: If you hit a roadblock while working through a challenge, click the Hint button. This provides a targeted contextual tip to point you in the right direction without spoiling the answer.
Mandatory vs. Optional Tasks: Answering Questions is mandatory to pass a section and earn progress points. Deeper lab walkthrough exercises are optional and are provided to round out your training. If an optional exercise features hidden details, you can reveal them by clicking the Reveal button.
Module Solutions
If you find yourself stuck on a difficult path, you can toggle step-by-step module solutions to review full, detailed technical walkthroughs.
Global Settings Activation: Open your main dashboard navigation header, select Academy Account Settings, and go to your preference controls. Locate the toggle switch labeled Show Solutions and switch it on.
In-Lesson Walkthrough Access: Once enabled globally, return to your active lesson to find an interactive toggle labeled Enable step-by-step solutions positioned right above your questions block. Flipping this toggle will automatically display a Show Solution button alongside individual questions.
Disabling Walkthroughs: If you want to challenge yourself without any help visible, return to your main settings panel and toggle the Show Solutions master switch back to the off position.




















