Issues With HackTheBox as a Community Member

Introduction

Hack The Box is a platform where people learn hacking and sharpen their offensive security skills. It’s well-regarded, and Microsoft even lists it on the MSRC List.

Despite being a great learning space, HTB suffers from a major issue. You might assume it’s about shady content or poor management. But that’s not the case. HTB is a community-driven and gamified platform that even runs an enterprise branch. Box creators get paid, and the community thrives through competitive seasons.

The Problem

The issue? Integrity of the content (cheating) during seasonal competitions.

Why does it matter, you might ask? Because HTB is a gamified platform, and to keep it competitive, the content has to stay intact.

HTB releases boxes as part of seasonal events. Active users compete to root them (gain “bloods”) and climb the leaderboard. These rewards include profile ranking, HTB cubes for Academy content, and recognition for real skill.

How Cheating Happens

However, some users leak solutions, breaking the rules to boost their teams or gain fake prestige. Flags and walkthroughs are shared privately or on forums like BreachForums, helping public teams reach the top 100 without solving anything themselves.

These actions directly violate Hack The Box’s Terms of Service and community guidelines.

You might wonder: what does “public teams” mean? On Hack The Box, teams are meant to be private, used to collaborate with trusted members only.

As stated in the community guidelines:

An Example

Sharing solutions to active content violates HTB’s TOS.

The Cost

Everything has its pros and cons, but the only thing with real cons here is cheating. For others—those who genuinely want to learn, grow, or even escape reality—it ruins the fun.

Some of these individuals:

• Spam leaked flags from forums
• Hold certifications like CRTO, OSCP, CPTS, and others
• Can’t type basic commands (like smbclient, flush dns, or any commands from the impacket-suite)
• Pretend to be skilled, yet fail at real-world challenges

Searching “flash dns command in kali linux” while claiming to be CRTO certified is embarrassing.

yes, intentionally typed flash dns.

Even funnier (and worse), one claimed to have bypasses on the most-used CDN and found XSS on a major LLM, yet couldn’t solve a basic machine on HTB.

Real-World Impact

This harms those who genuinely work hard and have real skills. While they struggle to get noticed, others with fake fame and connections easily land jobs. For example, one individual got hired on certifications and connections alone, despite lacking actual ability. The result? They failed on the job and exposed their lack of real-world skills.

HTB’s Actions

This high-ranked user (Guru/Omni level) was banned—then unbanned within hours.

But why? Oh wait, he has a social media presence too? That’s the craziest part. Made a review video on HTB content… is that why?

Lord knows best what’s in the hearts of people.

The person who called them out? Permanently banned by HTB. Wow. This fake “hacker” was later exposed for faking certifications and was fired from a senior job position. Yes, you read that right.

“SENIOR JOB POSITION”

Why? He couldn’t deliver a basic Active Directory presentation and struggled for 20 minutes with smbclient. Meanwhile, a teenager building BloodHound alternatives gets offered a low-paid internship. The system is broken.

This isn’t solely HTB’s fault, but it contributes. It’s the broader impact of cheating, fake careers, and unchecked fraud. HTB bans cheaters, but only temporarily. Cheaters get second chances. Legit users get banned for speaking out.

That’s not fair.

The Proof

Go ask any legit top HTB player. They’ll tell you exactly who the cheaters are.

Take one example: a user DMs good players begging for hints, somehow solves a challenge, and then passes the flags and writeups around.

Da Chart – Begging for Solutions

Begging for solutions on Discord, forums—anywhere possible.

Can you believe this? Cheating, still not banned

Ranked in the Top 3 while still asking for flags, Same user. Still not banned.

The activity tab is like a log of recent solves, one after another.

Activity Evidence

Summary

The real problem is integrity.

HTB keeps content active for about 6 months before retiring it. But where’s the integrity if that content is already leaked across the web?

The game becomes unfair. Cheaters boast after submitting leaked flags. It ruins the experience for those genuinely trying to learn.

Content quality is dropping too, but that’s a topic for another blog.

Temporary bans, weak enforcement, and unchecked reward systems fuel the problem. Real players get demotivated. Cheaters get rewarded.

Even worse: Cheating extends to HTB exams. While CPTS was updated to reduce abuse, paid modules and exam reports still get scraped and leaked.

HTB does a lot of good, but it needs to improve ban policies and protect the community better. Ban cheaters for longer than a few days, and let real learners compete fairly.

Funny thing? NLTE’s solves raise suspicion, and Mr Byte’s Z3ro gets DMs from staff asking how he got the blood and what methods he used— yet known cheaters walk free, claiming to be the Al-Khwarizmi of hacking… while struggling to spell smbclient, despite being a YouTuber reviewing “advanced” post-exploitation tools.

One even tried to run sudo please google flash-dns -- kali-linux— because hey, root solves everything, right?