Jr Penetration Tester

Web hacking, network security, Metasploit and privilege escalation: the core skills for a first pentesting role.

58 rooms, about 6 hours of reading

Start at room 1 Guided Pentest Web: Chaining Four Bugs to RCE
  1. 1 Guided Pentest Web: Chaining Four Bugs to RCE TryHackMe Guided Pentest Web walkthrough: an IDOR user dump, a reset token printed in the response, an admin panel, and a .phtml … 7 min
  2. 2 Guided Pentest Infrastructure: UnrealIRCd to Root TryHackMe Guided Pentest Infrastructure walkthrough: fingerprint UnrealIRCd 3.2.8.1, trigger the AB backdoor for a shell, escalate … 6 min
  3. 3 Dive Into Pentesting: Concepts, Ethics, Mindset TryHackMe Dive Into Pentesting walkthrough: the concepts, ethics, and mindset of a professional pentest, plus lifting the flag … 6 min
  4. 4 Cyber Kill Chain: The Seven Phases Explained TryHackMe Cyber Kill Chain walkthrough: the Lockheed Martin seven phases from reconnaissance to actions on objectives, plus … 6 min
  5. 5 Penetration Testing Frameworks: Pick the Right One TryHackMe Penetration Testing Frameworks walkthrough: OSSTMM, WSTG, NIST 800-115, PTES, ISSAF and MITRE ATT&CK, which to pick, and … 6 min
  6. 6 Walking An Application: Browser Dev Tools TryHackMe Walking An Application walkthrough: finding every flag with only the browser developer tools, view source, inspector, … 6 min
  7. 7 Content Discovery: Gobuster and Framework Docs TryHackMe Content Discovery walkthrough: robots.txt, sitemap.xml, HTTP headers, framework docs and Gobuster dir, dns and vhost … 7 min
  8. 8 Modern Web Stacks: Four Stacks, Four CVEs TryHackMe Modern Web Stacks walkthrough: fingerprint four stacks, then exploit prototype pollution, CVE-2025-29927, CVE-2021-35042 … 7 min
  9. 9 Web Server Attacks I: Four Servers, One Host TryHackMe Web Server Attacks I walkthrough: fingerprint Apache, Nginx, Node.js and Python http.server on one host, then loot every … 6 min
  10. 10 Web Server Attacks II: IIS Tilde and WebDAV TryHackMe Web Server Attacks II walkthrough: IIS fingerprinting, 8.3 tilde short name enumeration, WebDAV NTLM upload and ASP.NET … 8 min
  11. 11 SQL Injection Introduction: Four Lab Levels Walkthrough of the TryHackMe SQL Injection Introduction room: four lab levels covering UNION extraction, login bypass, … 7 min
  12. 12 CSRF Introduction: Forging a Weak Token Walkthrough of the TryHackMe CSRF Introduction room: forging a POST form against StaffHub and reversing a weak base64 CSRF token … 6 min
  13. 13 XSS Introduction: Six Payload Contexts Walkthrough of the TryHackMe XSS Introduction room: reflected, stored and DOM sinks, a blind XSS exfil over netcat, and six … 7 min
  14. 14 Broken Authentication: Four Ways Past a Login Walkthrough of the TryHackMe Broken Authentication room: ffuf username enumeration, login brute force, a reset parameter pollution … 7 min
  15. 15 API Pentesting: BOLA to Admin in Four Requests Walkthrough of the TryHackMe API Pentesting room: JWT decoding, BOLA object id swapping, an unrated login endpoint and mass … 9 min
  16. 16 Support: Five Weak Trust Boundaries to RCE Walkthrough of the TryHackMe Support challenge: a weak login, an md5 cookie flip, IDOR, readfile traversal for source disclosure … 8 min
  17. 17 Vulnerability Scanning Tools: Nmap, Nikto, OpenVAS Walkthrough of the TryHackMe Vulnerability Scanning Tools room: Nmap service scans, a Nikto web check and an OpenVAS report that … 6 min
  18. 18 Basic Vulnerability Identification Techniques Walkthrough of the TryHackMe Basic Vulnerability Identification Techniques room: nmap enumeration, IDOR, anonymous FTP and SMB, … 6 min
  19. 19 NoScope: Alf.io returnClass Sandbox Escape to RCE Walkthrough of TryHackMe NoScope: Finding RCE. Exploit the Alf.io returnClass Rhino sandbox escape (CVE-2026-35482) and read the … 6 min
  20. 20 n8n CVE-2025-68613: Expression Injection to RCE Walkthrough of the TryHackMe n8n CVE-2025-68613 room: an authenticated expression injection in n8n workflow evaluation escalates … 5 min
  21. 21 Fragnesia CVE-2026-46300: Page-Cache LPE to Root Walkthrough of TryHackMe Fragnesia, CVE-2026-46300. A Linux page-cache write LPE created by the Dirty Frag patch, taken from user … 9 min
  22. 22 CVE-2026-42945 Nginx Rift: Heap Overflow to RCE Walkthrough of the TryHackMe CVE-2026-42945 Nginx Rift room: the is_args two-pass state mismatch that turns a rewrite/set heap … 9 min
  23. 23 Phishing Basics: SET Credential Harvesting and Spoofing Walkthrough of the TryHackMe Phishing Basics room: social engineering psychology, email spoofing defences, and SET credential … 6 min
  24. 24 Introduction to Wordlists: CeWL, crunch, ffuf, Hydra TryHackMe Introduction to Wordlists walkthrough: scrape with CeWL, build usernames, crunch passwords, then find helios/ with ffuf … 7 min
  25. 25 Password Cracking: Hashcat, John, and rockyou TryHackMe Password Cracking walkthrough: identify MD5, SHA-256, NTLM, and bcrypt hashes, then crack all four with Hashcat, John, … 6 min
  26. 26 Checkmate: CUPP, SHA256, and SSH Password Cracking TryHackMe Checkmate walkthrough: default creds, a company keyword, CUPP to crack Marco's social password, a SHA256 filename, and a … 5 min
  27. 27 Metasploit: The Basics, msfconsole and EternalBlue TryHackMe Metasploit: The Basics walkthrough: exploits and payloads, msfconsole search, set and setg, running modules, sessions, … 5 min
  28. 28 Metasploit: Post-Exploitation, Meterpreter Loot TryHackMe Metasploit: Post-Exploitation walkthrough: psexec foothold, Meterpreter commands, a SAM hashdump for jchambers, hashcat … 6 min
  29. 29 Exploitation and Weaponisation: Proving Real Impact TryHackMe Exploitation and Weaponisation walkthrough: controlled exploitation, chaining vulnerabilities, and proving real business … 9 min
  30. 30 Metasploit Payload Generation: SMB Share to Meterpreter Walkthrough of TryHackMe Metasploit Payload Generation: msfvenom, multi/handler, and a capstone chaining an SMB upload to a … 4 min
  31. 31 Host-Server Configuration Reviews: CIS Audit Walkthrough Walk through TryHackMe Host-Server Configuration Reviews: CIS Benchmarks, DISA STIGs, and a SUID privilege escalation chain from a … 8 min
  32. 32 Linux Privilege Escalation: Enumeration Walkthrough TryHackMe Linux Privilege Escalation Enumeration walkthrough: manual OS, user, network and file enumeration on Ubuntu 24.04, … 5 min
  33. 33 Linux Privilege Escalation: Basics Walkthrough TryHackMe Linux Privilege Escalation Basics walkthrough: exploiting sudo, SUID, PATH hijacking, capabilities, cron and NFS across … 5 min
  34. 34 Linux Privilege Escalation: Automation Walkthrough TryHackMe Linux Privilege Escalation Automation walkthrough: LES, exploiting CVE-2025-32463 sudo-chwoot, pspy, and a sudo … 6 min
  35. 35 Jump: FTP Uploads to Root Through a Trusted Pipeline TryHackMe Jump walkthrough: anonymous FTP uploads run as recon_user, group writes reach dev_user, a PATH hijack on ps lands … 7 min
  36. 36 Active Directory Basics: Build a Forest TryHackMe Active Directory Basics walkthrough: promote a child domain controller, join a server, push a Restricted Groups GPO, and … 9 min
  37. 37 Intro to AD Authentication: NetNTLM to Golden Ticket TryHackMe Intro to AD Authentication walkthrough: NetNTLM challenge response, Kerberos tickets, NTLM cracking, Pass-the-Hash, … 8 min
  38. 38 Intro to AD Breaching: Kerbrute to LDAP Passback TryHackMe Intro to AD Breaching walkthrough: Kerbrute enumeration, Git and Jenkins credential leaks, NetExec spraying, LDAP … 10 min
  39. 39 AD Basic Enumeration: Null Sessions to First Creds TryHackMe AD Basic Enumeration walkthrough: fping and nmap host discovery, anonymous SMB shares, LDAP and RPC null sessions, and … 8 min
  40. 40 AD Authenticated Enumeration: AS-REP to Graph TryHackMe AD Authenticated Enumeration walkthrough: AS-REP roasting with GetNPUsers and hashcat, net user enumeration, and … 10 min
  41. 41 Intro to Credential Harvesting: SAM to DCSync TryHackMe Intro to Credential Harvesting walkthrough: SAM and LSA dumps with secretsdump, DPAPI vault looting, DCC2 cracking, … 7 min
  42. 42 Intro to AD Lateral Movement: PsExec to Pivot TryHackMe Intro to AD Lateral Movement walkthrough: PsExec and Evil-WinRM remote execution, Pass-the-Hash credential reuse, and an … 8 min
  43. 43 Proxy: Coerced Hash to Constrained Delegation TryHackMe Proxy walkthrough: a writable SMB share that executes PowerShell, a coerced NetNTLMv2 hash, and Kerberos constrained … 5 min
  44. 44 Forward: Kerberoast Red Herring to RBCD TryHackMe Forward walkthrough: a Kerberoastable red herring, a KeePass credential reused across accounts, and resource-based … 5 min
  45. 45 Mobile Application Security: MobSF Static Analysis Walkthrough of TryHackMe Mobile Application Security: MobSF static analysis of the Leaky Package APK and IPA, mapped to the OWASP … 6 min
  46. 46 Cloud Security Fundamentals: SSRF to IMDS Chain TryHackMe Cloud Security Fundamentals walkthrough: a guided chain from port scan to public bucket, SSRF to the IMDS, stolen creds … 7 min
  47. 47 The Blue Team Perspective: Splunk BOTSv1 Triage Walkthrough of TryHackMe The Blue Team Perspective: triage the Wayne Corp breach in Splunk over the BOTSv1 dataset, mapped to … 8 min
  48. 48 DevSecOps Basics: Shifting Security Left Walkthrough of TryHackMe DevSecOps Basics: the story from Waterfall to Agile to DevOps, shifting security left, DevSecOps culture, … 6 min
  49. 49 Python Core Concepts: Types, Lists, Loops Walkthrough of TryHackMe Python Core Concepts: data types, strings, lists and dictionaries, operators, and for and while loops, … 5 min
  50. 50 Python Building Scripts: Functions to a Checker Walkthrough of TryHackMe Python Building Scripts: functions with return and defaults, try except error handling, file I/O, pip … 5 min
  51. 51 Python Pentesting Scripts: Recon Toolkit Walkthrough of TryHackMe Python Pentesting Scripts: web directory enumeration, Scapy ARP and socket port scanning, hashlib … 6 min
  52. 52 Threat Modeling for Pentesters: STRIDE to ATT&CK Walkthrough of TryHackMe Threat Modeling for Pentesters: STRIDE threat categories, DREAD scoring, PASTA stages, MITRE ATT&CK … 7 min
  53. 53 Planning and Scoping: Scope, RoE, Compliance Walkthrough of TryHackMe Planning and Scoping: PTES, known and unknown environments, allowlist scope, Rules of Engagement, PCI … 6 min
  54. 54 Writing Pentest Reports: Structure and QA Walkthrough of TryHackMe Writing Pentest Reports: structure, technical vs business audience, vulnerability write-ups, appendices, … 5 min
  55. 55 Re-Testing: Verify Fixes, Catch Patches Walkthrough of TryHackMe Re-Testing: re-test vs reassessment, pass/fail/risk-accepted outcomes, variant SQLi payloads, incomplete … 6 min
  56. 56 Domino: IDOR to Forged JWT to RCE to Root Walkthrough of TryHackMe Domino: weak creds, IDOR, forged session cookie and JWT, an RFI eval sink for RCE, SSH credential reuse, … 7 min
  57. 57 Silent Monitor: SQLi, Command Injection, KeePass to Root Walkthrough of TryHackMe Silent Monitor: SQLi login bypass, newline command injection in a ping tool, a leaked service password, … 6 min
  58. 58 Dead Drop: SQLi, require() RCE, and AddSelf to Domain Admin Walkthrough of TryHackMe Dead Drop: SQLi login bypass, a Node require() RCE, an APK credential leak, and an AddSelf ACL abuse that … 7 min