Listen to this Post
Introduction:
For years, HackTheBox has reigned as the undisputed kingdom for hands-on cybersecurity training, allowing users to “hack their way in” to learn by doing. However, with the explosive rise of Generative AI and Large Language Models, the landscape of technical education is shifting beneath our feet. As debated in the recent CyberTalk18 session featuring HackTheBox Ambassador Matthieu Billaux, we must ask: Is the traditional “queen” of learning platforms losing her crown to AI? This article dives deep into the current state of cybersecurity education, exploring how AI is reshaping skill development, the continued relevance of platforms like HackTheBox, and the concrete commands and strategies you need to survive in this new ecosystem.
Learning Objectives:
- Understand the evolving relationship between AI-driven development and traditional pentesting platforms.
- Learn to integrate AI tools into your workflow for vulnerability research without compromising foundational knowledge.
- Master essential Linux and Windows commands to verify AI-generated exploit suggestions and security configurations.
You Should Know:
- The State of Play: HackTheBox vs. The AI Tutor
HackTheBox (HTB) revolutionized learning by providing a gamified environment where users attack vulnerable machines. However, as discussed by Nicolas Gomez and Noobosaurus R3x, the introduction of AI changes the dynamic. A student can now ask an AI to “write a Python script to exploit CVE-2021-4034 (PwnKit)” or “explain how to perform a Kerberoasting attack.”
While this accelerates learning, it risks creating a generation of “script kiddies” who can execute attacks but do not understand the underlying `LD_PRELOAD` trick or the Kerberos protocol. The consensus from the panel is that HTB remains vital because it provides the target range, while AI serves as the on-demand instructor.
Step‑by‑step guide: Using AI to aid HTB challenges (Linux Focus)
Instead of letting AI do all the work, use it to understand the why.
1. Initial Scan: On your Kali Linux machine, run the standard enumeration.
sudo nmap -sC -sV -oA initial_scan <target_ip>
2. AI Interaction: Copy the results into an AI prompt (like ChatGPT or ). Ask: “Based on these Nmap results, what are the top three potential attack vectors? Do not give me the full exploit, just the theory and the services to research.”
3. Manual Verification: Use the AI’s suggestions to guide your manual research.
If AI suggests a vulnerable SMB version smbclient -L //<target_ip> -N Or check for known vulnerabilities searchsploit "Samba 3.x"
- The AI Influence: Automating Reconnaissance and Code Analysis
One of the biggest shifts highlighted in the talk is the use of AI to parse massive amounts of code or log data. In the context of application security (AppSec) or cloud hardening, AI can now review Infrastructure as Code (IaC) scripts faster than a human. However, AI “hallucinations” mean you must verify its output.
Step‑by‑step guide: Auditing a Terraform script with AI and CLI tools
Let’s assume you have a Terraform file (main.tf) that defines an AWS S3 bucket.
1. AI Audit: Paste the `main.tf` into an AI and ask: “Identify any security misconfigurations in this AWS Terraform script.” The AI might point out that `acl = “public-read”` is dangerous.
2. CLI Verification (Cloud Hardening): You must verify this with the AWS CLI to ensure no live environment is exposed.
Install and configure AWS CLI aws configure Check the actual bucket ACL (if it exists) aws s3api get-bucket-acl --bucket your-bucket-name Check if public access is blocked aws s3api get-public-access-block --bucket your-bucket-name
3. Remediation: Use the AI’s suggestion to fix the code, then use `terraform plan` to verify the changes before applying them.
- Windows Domain Exploitation: The “Noob” to “Pro” Gap
The panel touched on how AI can explain complex Windows AD attacks. A beginner might ask how to perform a DCSync attack. The AI will explain it requires Domain Admin rights and involves replicating directory services via theDRSUAPI. However, without foundational knowledge, a user might run the tools incorrectly and crash a Domain Controller.
Step‑by‑step guide: Simulating a DCSync attack (for learning)
Note: Only perform this in a controlled lab environment like HackTheBox or your own homelab.
1. Compromise a machine: Gain a shell with Domain Admin privileges.
2. Transfer Impacket tools: On your attacking machine (Linux), use `smbclient` or `wget` to transfer `secretsdump.py` to the compromised Windows machine if needed, but typically you run it from your Kali against the DC.
3. Execute the Attack:
From your Kali Linux, using stolen Domain Admin credentials impacket-secretsdump -just-dc-user "DOMAIN"/"krbtgt":"HASH"@<DC_IP>
Understanding: The `-just-dc` flag utilizes the Directory Replication Service (DRS) protocol to simulate a domain controller requesting an update, thus dumping password hashes.
4. Mitigation Check: On a Windows Server (Domain Controller), open PowerShell as Admin to verify security settings.
Check which users have "Replicating Directory Changes" permissions
Get-ADObject -SearchBase "CN=Configuration,DC=domain,DC=local" -Filter { ObjectClass -eq 'user' } -Properties | Select-Object Name, DistinguishedName | Out-GridView
4. API Security: The New Frontier
With AI generating front-end code rapidly, APIs are becoming the primary attack surface. The CyberTalk discussion implied that as AI generates more back-end code, the “human” oversight on API rate limiting and authentication often fails.
Step‑by‑step guide: Testing API Rate Limiting
- Intercept Traffic: Use Burp Suite or `curl` to capture an API request.
- Automate with a Bash Script (Linux): Create a simple loop to test for rate limiting.
!/bin/bash url="https://target-api.com/v1/endpoint" for i in {1..100} do curl -X POST $url -H "Authorization: Bearer [bash]" -d '{"data":"test"}' -w " Request $i: %{http_code}\n" -o /dev/null -s sleep 0.5 Adjust speed done - Analyze Output: If you get a `200 OK` for all 100 requests instantly, the API has no rate limiting—a critical flaw that could lead to Denial of Service or brute-force attacks. If you get a `429 Too Many Requests` later, rate limiting is present.
5. Linux Privilege Escalation: The Core Skill
Regardless of AI, the ability to manually enumerate a Linux box remains the cornerstone of a cybersecurity professional. AI can suggest “LinPEAS,” but knowing how to manually find a SUID binary is what separates a professional from a script-runner.
Step‑by‑step guide: Manual Enumeration vs. AI Assistance
- AI “I have a low-privilege shell on a Linux machine. How do I find misconfigured sudo permissions?”
2. AI Output: “Run `sudo -l`.”
3. Manual Execution (Verification):
Check sudo permissions without a password sudo -l Find all SUID binaries find / -perm -4000 2>/dev/null Check kernel version for exploits uname -a
4. Exploitation: If `sudo -l` shows you can run `/usr/bin/vim` as root, you don’t need an AI to tell you how to break out of it, but you can use it to verify the syntax.
sudo vim -c ':!/bin/sh'
This command opens vim with root privileges and immediately spawns a shell, giving you root access.
What Undercode Say:
- AI is a Tool, Not a Teacher: HackTheBox forces you to think, struggle, and fail. AI offers shortcuts. Using AI to understand why you failed is the correct path; using it to avoid the struggle will leave you with a fragile skillset.
- Verification is Mandatory: AI “hallucinates” commands and IP addresses. Every command suggested by an AI must be treated as suspicious until manually verified in a sandboxed environment or against official documentation.
- Platforms Must Adapt: The success of HackTheBox in 2026 will depend on its ability to integrate AI as a coach rather than a cheat sheet. The human element of threat hunting and lateral thinking cannot be replicated by algorithms yet.
- Cybersecurity is Still a Future-Proof Career: As the panel concluded, AI creates more attack surfaces (AI prompt injection, model poisoning) and requires experts who can understand and mitigate these novel threats, not just run scans. The “Noob” who relies solely on AI will be filtered out; the “Pro” who uses AI to augment their deep knowledge will thrive.
Prediction:
Within the next 24 months, we will see the emergence of “AI-vs-AI” Capture The Flag (CTF) competitions where human teams use autonomous AI agents to perform initial reconnaissance while humans focus on deep vulnerability chaining. Platforms like HackTheBox will bifurcate into “Classic” modes (no AI assistance allowed) and “Augmented” modes where using AI tools is part of the challenge, simulating the real-world workflow of the modern security engineer. The cybersecurity professional of 2027 will be judged not by the commands they remember, but by the quality of the questions they ask their AI co-pilots.
▶️ Related Video (84% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Nicolas Gomez – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
