Where HackTheBox helps is with creative thinking and understanding attack chains. Many of the boxes themselves are not what people professionally do day to day. However, the attack chains you learn from doing them will help. Command injection isn't always straightforward there's a lot of small tricks you pick up. For example, the machine that just retired today had Apache Uno which allows you to specify a binary and the first argument. Which I had a heck of a time getting RCE without dropping a program to disk and executing that. After publishing the video, someone pointed out you could use AWK in order to get RCE within these constraints. You pick up tons of things like that, which work in extremely niche scenarios. That situation may not come up anytime in the near future, but knowing 100 niche scenarios means most of the time when an exploit fails initially I'll know another trick to try. With work, I find it hard to really figure out how things work under the hood since you can't always take time to play with things or even take the risk of playing with it, as if things go wrong it can go south very fast. In a CTF there's no limitation on how much time you spend, or intrusive actions you take in order to learn the most you can. Answer from Ipp on reddit.com