Attack graph
Hosts, services and credentials as linked nodes. Auto-layout untangles a large network in one click, and undo reverses a bad move.
Free offline CTF tracker and OSCP exam simulator
Track your Hack The Box and TryHackMe machines in one CTF progress tracker, then rehearse OSCP, CPTS, CRTO, OSEP, CRTP, PNPT and OSWE exams. Your data stays in your browser.
- 1,376machines catalogued
- 131reverse shells
- 7exam tracks
- No accountSource available on GitHub
A CTF progress tracker with one board per box, from nmap to report
Commands, credentials, notes and status for every target live in one place, and none of it needs a login. Start from the Hack The Box and TryHackMe catalog or add your own lab targets.
Table with bulk actions
Sort and filter the whole catalog, then select several machines and act on them together.
Evidence vault
Credentials, hashes, keys and flags from every target in one searchable table. Secrets stay masked until you reveal them.
Multi-host nmap import
Scan a subnet with -oX and import the XML. Each live host lands on the board with its open ports and services.
$ nmap -sV -oX sweep.xml 10.129.14.0/28
Nmap scan report for 10.129.14.17
22/tcp open ssh OpenSSH 8.2p1
80/tcp open http Apache 2.4.41
3306/tcp open mysql MySQL 8.0.28
Nmap scan report for 10.129.14.21
445/tcp open smb Samba 4.6.2
5985/tcp open winrm WinRM
# 2 hosts, 5 ports, ready to import
OSCP exam simulator: rehearse before you sit it
A timed simulator with a live clock and a points burndown, so you see whether you are on pace while there is still time to change plan.
Planning your 24 hours? Read the OSCP scoring and time budget guide and start your write-up from the OSCP report template. Working toward CPTS? See the HTB CPTS exam guide.
- OSCP
- CPTS
- CRTO
- OSEP
- CRTP
- PNPT
- OSWE
- Track-aware pacing. Hours and point targets follow the track you pick.
- Rabbit-hole warning. A nudge when one box is eating the clock.
- Proofs. Attach proof and screenshots to each box as you go.
- Findings with CVSS 3.1. Score each finding for the report.
- Zip submission bundle. Report, proofs and findings in one download.
Notes, evidence vault and writeups in one workspace
Move your workspace between devices with an encrypted sync file.
CTF tracker
CTF progress tracker: Kanban, table and grid board for Hack The Box and TryHackMe machines.
Methodology
Eight-phase attack lifecycle with copyable commands.
Snippets
Interactive pentest cheatsheets with dynamic LHOST, LPORT and IP substitution.
Reverse shells
Reverse shell generator that fills in your LHOST and LPORT.
Notes
Notes app for your own Obsidian vault, with wikilinks and a private local vault.
Exam simulator
OSCP exam simulator with CPTS, CRTO, OSEP, CRTP, PNPT and OSWE tracks and scoring.
Writeups
CTF writeup and report editor with templates, live preview and export.
Analytics
Skill radar, activity heatmap and benchmarks.
Evidence vault
Credentials, flags and hashes from every target.
Your pentest notes stay in your browser
The tracker app has no account, no analytics and no server holding your data. The public pages on this site, including this one, count page views with cookieless Cloudflare Web Analytics.
The source is public on GitHub, so you can check what it stores and what it sends. Read the privacy page for the details.
- Stored in
- LocalStorage and IndexedDB on your device. Clearing site data erases it.
- Backups and sync
- JSON export and restore, with optional passphrase encryption. Sync files for moving progress between your devices are always encrypted, and nothing leaves your device unless you move the file yourself.
- No app telemetry
- The tracker app has no analytics and no backend. Your data stays in your browser.
Free CTF tools, cheatsheets and guides
Free static references you can read without opening the app, from the OSCP-like machine list to the OSCP report template.
- Hack The Box and TryHackMe machine list1,031 boxes55 solved attack paths, plus a directory of every HTB and THM box.
- Reverse shell cheat sheet131 shellsOne-liners for Bash, Python, PHP, PowerShell and more.
- Pentest methodology8 phasesFrom host discovery to post-exploitation.
- OSCP and CTF cheatsheets7 topicsRecon, web, privesc, Active Directory, pivoting.
- OSCP-like machines110 boxesHTB and THM boxes for OSCP prep, grouped by difficulty.
- Pentest techniquesActive Directory, SQL injection, privilege escalation and pivoting, with commands and practice machines.
- Pentest methodology notes12 notesShort general notes with commands.
- OSCP points calculatorTick your flags and see your total against the pass mark.
- OSCP exam scoring and time budgetPoint structure, passing combinations and an hour-by-hour 24h plan.
- TJ Null OSCP list trackerWhat the list is, how to work it, and the HTB boxes from it you can track.
- OSCP report templateA Markdown report skeleton with a finding template and a CVSS 3.1 example.
- HTB and THM progress trackerWhat the platforms do not track, and a workflow that fills the gap.
- HTB CPTS exam guideExam format, flags, passing requirement and a day-by-day pacing plan.
- HTB vs TryHackMe: Which for OSCP, Beginners, AD?HTB vs TryHackMe compared with catalogue data: 580 HTB and 451 THM machines by OS, difficulty and OSCP tags, and which to use. Free.
- HTB Pro Labs Guide: Dante, Zephyr, Offshore ComparedCompare all 10 Hack The Box Pro Labs (Genesis, Dante, Zephyr, Offshore, RastaLabs, Cybernetics) by hosts, flags, difficulty and CPTS, OSCP or CRTO fit.
Frequently asked questions
Something else? Ask on GitHub
Is ZeroBox free?
Yes. ZeroBox is free to use in your browser with no signup. The source is public on GitHub under the ZeroBox Source-Available Non-Commercial License (ZNSL 1.0).
Does ZeroBox work offline?
Yes. After your first visit a service worker caches the app, so it keeps working completely offline. There is no backend, the app has no telemetry, and your data stays on your device.
Where is my data stored?
Only in your own browser, in LocalStorage and IndexedDB. Nothing is uploaded to a server. Clearing site data erases it, so use the built-in JSON backup and restore to keep a copy.
What is a CTF tracker?
A CTF tracker is a place to log the machines and challenges you work on, with each target's status, IP address, notes, credentials and flags. ZeroBox is a free CTF tracker with Kanban, table and grid boards that runs in your browser and works offline.
Which platforms and machines are supported?
ZeroBox ships with a pre-loaded catalog of 1,376 CTF machines across Hack The Box, TryHackMe, Proving Grounds and VulnHub. It also has 10 Pro Lab presets, such as Dante, Zephyr and Offshore, that fill in only the public lab name, difficulty and official link when you add a Pro Lab as your own target. You can also add custom targets for any other lab or live CTF. Progress is tracked locally because ZeroBox does not connect to external accounts.
Which certification exams can I simulate?
The exam simulator includes timed practice for 7 tracks: OSCP (23h45m), CPTS (10 days), CRTO (48h), OSEP (48h), CRTP (24h), PNPT (5 days) and OSWE (47h45m), with live clocks, point burndown against pass thresholds, rabbit-hole warnings, proof uploads and exportable submission reports.
Does ZeroBox comply with Hack The Box rules for active machines and Pro Labs?
Yes. ZeroBox strictly enforces Hack The Box Acceptable Use Policy (AUP §8.2). Active seasonal machines and enterprise Pro Labs are limited to public listing metadata (name, scope/host count, difficulty, and official link). Walkthroughs, attack vectors, intel hints, flags, and writeups are strictly excluded. ZeroBox operates entirely offline in your browser and transmits no network telemetry.
Is there a desktop app?
Yes. Desktop installers are published on GitHub Releases, and you can also build the Tauri app from source using the instructions in the GitHub README.
Start your next box with a board.
Free and offline, with the source public on GitHub. A desktop build is available from GitHub Releases.