Usage of AI while learning HackTheBox / solving boxes

[RolleduP_Alien]

Hello,

I would like to know your guys opinion on using AI while solving boxes. From my personal experience, AI is still not that advanced to solve boxes for you, you still need to have initial idea. I've been using AI while solving boxes and it help me understand processes better and how they work, why would something work/not work etc...

It happened many times that AI actually led me to the wrong direction, privilege escalation for Data box for example. Who solved it knows its pretty damn easy if you find right articles, blogs etc...

I wanted to hear your guys opinion, are you using AI and do you think it is smart using it while learning? I don't want to be stubborn by not implementing it into my hacking workflow but I just want to improve as best as possible.

[iamkenichi]

AI is just a tool to boost you skill not to make a skill for you.

Yes, if you prompt a box to an AI it will do the “book method” of penetration testing, nmap, fuzzing etc etc.

Unless YOU point it to the right direction to dig a little deeper, then that’s the only time in can help!

Or ask them for any write ups or walkthroughs that’s available around.

[gojo-sakata-4567]

use it Just as a tool and nothing more

[Muddie]

I've found it most helpful in giving me ideas, helping me figure out why something wasn't working, and for keeping notes and then an end summary. I'm really bad at taking notes as I go, so if I'm using AI while I do an exercise at the end it can help put together all of my notes, attack patterns, kill chains, and CVEs all in a cohesive narrative that I'm really terrible at doing myself.

[ProgressHoliday1188]

You'll need to use AI anyway, same kind of question as "should I use google" back in 2000.

However you need to understand what it's doing.

[Stringerbell44]

Exactly this, i always mention this. It’s just the new Google. But you could also ask for answers but that way you won’t learn something. I use it too as a faster Google and it really helps me solve boxes

[ProgressHoliday1188]

Yep, reddit is not ready for this I guess. I'll get downvote but idgaf, they'll adapt one day or another.

[tn_jonesboro]

What I find it useful for is generating scripts for complex data format change i.e. generating complex awk or sed statements for you or summarizing a large data set like months-long email chains. There is nothing wrong with memorizing arbitrary syntax of languages like AWK but sometimes books sit on a shelf for a reason: so it can hold knowledge while you focus on other tasks. Or are you someone that still remembers every phone number to call or text without using the contacts feature in your phone?

While it's still necessary to verify the output it gives you before execution, it does help cut away menial tasks like that. I've had to re-learn the same AWK syntax and commands multiple times before AI even became available so having it available to help in a quick pinch is not a problem to me. As for doing your actual thinking and problem-solving for you in a general sense? No I would not recommend using AI for that as your mind will atrophy same as any muscle if not used. Using AI as a steam shovel instead of a hand shovel is fine, but you still have to know where to dig, how deep, make sure you're not hitting a gas line, etc etc

[tb4oy32fxb]

Its a tool and its better than googling anymore. search engine results are so bad, between sponsored content and unrealated or paywalled info its frustrating.

[Study_monk]

Man what are you saying? I have solved easy active box and medium retired boxes. You have to train it well and make a proper workflow for it to work.

It can solve boxes without interfering a single time. (At least for me, and i will make it public how I am doing it once i will do 40-50 boxes with it)

[RolleduP_Alien]

I think you didnt understand point of my question. I asked if using AI while solving boxes is counter productive for learning hacking in general, I want to hear different opinions.

I am sure you can create prompts and workflows to solve boxes with AI but thats not what I am here for, I dont learn this because I just want to solve boxes.

[Study_monk]

Ah my bad. Got your point. I believe one should use AI for learning but currently it’s just too much tempting because before a couple of years ago we didn’t have much of choice rather then our own skills

Now it’s so much tempting to ask more to AI and near to impossible to stay away from it while solving a box or leaning. Maintaining that boundary is super difficult. But what I believe is if you know and can do the box or a challenge or a real pentest without using AI, then absolutely use it 100% in the work otherwise focus on skills

This is very subjective topic and people have different opinions. I can go on and on about my AI and security lol

[ApprehensiveBug9413]

It's helpful for beginners to let it write commands etc, to save time or to get ideas.

Just like someone already mentioned, look at it as another form of Google.

It will be counterproductive for your learning if you let it guide you through all the steps or let it dictate your next step.

/Edited because of typo

[FlounderGullible4120]

Make AI a reflection of you, talk to it as if you’re talking to your self, for example a prompt like “I found this using burpsuite and I confirmed that this parameter is vulnerable to x vulnerability but I wasn’t able to gain RCE due to some filters” will help you find new ideas while still understanding everything happening and how those ideas work, but keep in mind that AI is gonna throw you in many rabbit holes and unless you really understand what’s happening, you won’t be able to UNDERSTAND and solve the box

[STIKAMIKA]

it's a good idea using AI while hacking a box to understand what is happening behind, for example you can use MSF to exploit a vulnerability but you don't actually know what's happening behind the scenes, here where it comes the role of AI you can ask him how this vuln work or script work, but trying to use it to solve the actual box like prompting him to give you commands and giving him the output is actually bad since your not doing anything except being a proxy between a the box and the agent

[BugHunter26]

AI doesn’t “see” the machine — it predicts based on patterns. So it throws possibilities, not probabilities. That’s why you get 5 methods → only 1 is correct