Free Red Teaming Training on TryHackMe to Build Your Skills in 2026

Red teaming is one of the most in-demand disciplines in cyber security right now and one of the hardest to learn without an expensive lab setup, a training budget, or a mentor who's already done it.

TryHackMe removes all of that. With 70+ free rooms built around real offensive security scenarios, you can go from understanding what a penetration test involves to executing Active Directory attacks, chaining web vulnerabilities, and operating with red team OPSEC, all in your browser, at no cost.

This guide organises every free red teaming room on TryHackMe by skill area. Whether you're starting from scratch or targeting a specific gap, pick the section that fits and get building.

Where to start:

If you're new to offensive security, follow this order: Basics & Fundamentals → Reconnaissance & Network → Web Application → Active Directory → Privilege Escalation → Tooling & Exploitation → Methodology & Social Engineering. Already comfortable with the foundations? Jump straight to the section where you want to level up.

Basics & Fundamentals

Every red teamer needs a solid foundation. These rooms cover the core skills - Linux, Windows, networking, Python, and cryptography, that you'll rely on across every engagement.

• Offensive Security Intro — Your first look at what offensive security actually involves. A hands-on introduction to the mindset and methodology before you go any further.
• Linux Fundamentals Part 1 — The command line is your primary tool as a red teamer. This room gets you comfortable with Linux from the ground up.
• Windows Fundamentals 1 — Most enterprise environments run Windows. Understanding how it works is essential for exploiting it.
• Windows Fundamentals 2 — Goes deeper into the Windows OS: file systems, permissions, and the tools attackers and defenders both rely on.
• Windows Command Line — A red teamer needs to operate in Windows environments without a GUI. This room builds that command-line fluency.
• Networking Concepts — TCP/IP, ports, protocols — the network fundamentals that underpin every phase of reconnaissance and exploitation.
• Cryptography Basics — Understand encryption, hashing, and PKI. Relevant everywhere from cracking credentials to understanding HTTPS.
• Web Application Basics — How web apps work, HTTP requests, and the mechanics behind the vulnerabilities you'll exploit later.
• Python: Core Concepts — Write scripts, automate tasks, and build your own tools. Python is the language of choice for offensive security work.

Reconnaissance & Network

Recon is where every engagement starts. These rooms cover OSINT techniques, active and passive reconnaissance, Nmap, and network service enumeration the skills that tell you what you're working with before you start exploiting it.

• Search Skills — Learn to use search engines like an attacker. A foundational OSINT skill you'll use on every engagement.
• OhSINT — A practical OSINT challenge: use open-source intelligence to investigate a target from a single starting point.
• Google Dorking — Discover exposed files, login pages, and sensitive data using advanced Google search operators.
• Passive Reconnaissance — Gather intelligence on a target without touching their systems. Covers WHOIS, DNS, and public data sources.
• Active Reconnaissance — Move beyond passive techniques to direct interaction with target systems, including web-based and host-level recon.
• Nmap Live Host Discovery — Find live hosts on a network using ARP, ICMP, and TCP/UDP ping scans.
• Nmap Basic Port Scans — Build on host discovery with targeted port scanning to identify open services.
• Network Services 2 — Enumerate and brute-force common network services to find misconfigurations and weak credentials.
• Wireless Security — Understand and exploit wireless network vulnerabilities — a relevant attack surface in physical red team engagements.
• Understanding Vulnerability Databases — Navigate CVE databases and vulnerability research resources to identify known weaknesses in target systems.
• Vulnerability Scanning Tools — Hands-on practice with the scanners you'll use during the enumeration phase of any engagement.
• Guided Pentest: Infrastructure — A full infrastructure pentest walkthrough using Nmap and Metasploit. Ties together recon and exploitation in one guided scenario.

Web Application

Web application vulnerabilities are one of the most common attack vectors in real engagements. These rooms cover the full offensive web skill set from SQL injection and XSS to chaining vulnerabilities and evading WAFs.

• OWASP Top 10 2025: IAAA Failures — Authentication and authorisation failures are consistently the most exploited vulnerability class. Learn how to find and exploit them.
• SQL Injection Introduction — The fundamentals of SQL injection, from manual techniques to understanding the underlying vulnerability.
• Advanced SQL Injection — Go beyond the basics with blind SQLi, error-based extraction, and automation with SQLMap.
• NoSQL Injection — Attack NoSQL databases — an increasingly common vulnerability as modern stacks adopt MongoDB and similar technologies.
• XSS — Cross-Site Scripting: find it, exploit it, and understand the client-side attack surface.
• CSRF — Exploit Cross-Site Request Forgery to force authenticated actions on behalf of victims.
• SSRF — Server-Side Request Forgery: trick servers into making requests to internal resources.
• Content Discovery — Use Gobuster, ffuf, and dirb to find hidden files, directories, and endpoints that weren't meant to be public.
• WAF: Introduction — Understand Web Application Firewalls and learn the bypass techniques that matter in real engagements.
• Chaining Vulnerabilities — Individual vulnerabilities are often low-impact. This room teaches how to chain them together for real access.
• Insecure Deserialisation — Exploit insecure deserialisation vulnerabilities to achieve remote code execution and privilege escalation.
• Insecure Randomness — Exploit weak random number generation in authentication and cryptographic implementations.
• Breaking Crypto the Simple Way — Exploit the cryptographic failures developers actually make in real-world applications.
• Input Manipulation & Prompt Injection — Attack AI and LLM integrations through prompt injection and input manipulation — a rapidly growing attack surface.
• BankGPT — A challenge room focused on attacking AI-powered web applications in a realistic scenario.
• Web Frameworks: Code Review — Identify vulnerabilities through source code review — a skill that separates good pentesters from great ones.
• Re-Testing — Learn how to verify that a vulnerability has actually been remediated — an essential part of any professional engagement.
• Guided Pentest: Web — A full guided web application pentest that ties together everything in this section in one realistic scenario.

Active Directory

Active Directory is present in almost every enterprise environment and attacking it is a core skill for any red teamer. These rooms cover the full AD attack chain: initial access, authentication attacks, enumeration, exploitation, and post-exploitation.

• Active Directory Basics — Understand how Active Directory works before you attack it. Users, groups, domain controllers, GPOs, and trust relationships.
• Intro to AD Breaching — The first step in any AD engagement: how to gain your initial foothold in an Active Directory environment.
• Intro to AD Authentication — NTLM, Kerberos, and password cracking. Understanding AD authentication is how you know what to attack.
• AD: Basic Enumeration — Enumerate an Active Directory environment to map users, groups, computers, and relationships before you start exploiting them.
• Attacktive Directory — Hands-on AD exploitation covering AS-REP roasting, Kerberoasting, and Kerberos-based attacks.
• VulnNet: Roasted — A realistic AD pentest scenario built around Kerberoasting and enumeration techniques.
• AD Certificate Templates — ADCS abuse is one of the most impactful attack paths in modern enterprise environments. Learn how to find and exploit misconfigured certificate templates.
• Post-Exploitation Basics — Once you're in, what next? BloodHound, Mimikatz, and the techniques red teamers use after initial access.

Privilege Escalation

Getting a foothold isn't enough. Privilege escalation is how you go from a standard user to SYSTEM or root and it's one of the most technically rich areas of offensive security. These rooms cover both Linux and Windows, from enumeration through to CVE exploitation.

• Linux Privilege Escalation: Enumeration — Before you escalate, you enumerate. Learn the systematic approach to finding privilege escalation vectors on Linux.
• Linux Privilege Escalation — Hands-on Linux privesc using LinPEAS, kernel exploits, SUID binaries, and misconfigured services.
• Linux PrivEsc Arena — A dedicated practice environment with multiple privilege escalation vectors to work through at your own pace.
• Windows PrivEsc — Windows privilege escalation: service misconfigurations, DLL hijacking, token impersonation, and more.
• Windows PrivEsc Arena — A dedicated Windows privilege escalation practice environment to drill the techniques until they're second nature.
• Sudo Buffer Overflow — Exploit a buffer overflow vulnerability in sudo to escalate privileges on Linux.
• Host-Server Configuration Reviews — Assess host and server configurations to identify privilege escalation vectors — the kind of misconfiguration that shows up constantly in real environments.
• CVE-2026-46300: Fragnesia — Exploit a real Linux privilege escalation CVE in a hands-on environment.

Tooling & Exploitation

A red teamer is only as effective as their toolkit. These rooms cover the most widely used offensive security tools - Metasploit, Hydra, Burp Suite, CyberChef, and more plus building your own custom tooling with Python.

• Metasploit: Introduction — Learn the Metasploit framework from the ground up: modules, payloads, and your first exploitation.
• Metasploit: The Basics — Build on the introduction with deeper coverage of Metasploit and real exploitation scenarios.
• Blue — Deploy and exploit a Windows machine using EternalBlue. One of the most iconic vulnerabilities in the history of offensive security.
• Hydra — Brute-force credentials across services using Hydra. A staple tool for any penetration tester.
• Crack the Hash — Practice cracking password hashes with Hashcat and John the Ripper — a skill you'll use constantly in Active Directory environments.
• CyberChef: The Basics — Encode, decode, encrypt, and analyse data with CyberChef. Invaluable for manipulating and understanding data during an engagement.
• Burp Suite: Repeater — Use Burp Suite's Repeater to modify and replay HTTP requests — a core skill for manual web application testing.
• SQLMAP — Automate SQL injection attacks with SQLMap. Learn to use the tool efficiently and understand exactly what it's doing under the hood.
• Custom Tooling Using Python — Write your own offensive security tools in Python. Automation and custom tooling is what separates proficient red teamers from exceptional ones.

Methodology & Social Engineering

Technical skills get you far — but understanding red team methodology, OPSEC, and social engineering makes you a complete operator. These rooms cover the operational side of red teaming, from planning and threat intelligence to phishing campaigns and writing the final report.

• Red Team Fundamentals — What red teaming actually is, how it differs from penetration testing, and how engagements are structured. Start here if you're new to the discipline.
• Red Team Threat Intel — How to use threat intelligence to emulate real adversaries. Covers the MITRE ATT&CK framework and adversary emulation planning.
• Red Team OPSEC — Operational security for red teamers: how to operate without getting caught. A critical skill for realistic, long-duration engagements.
• Pentesting Fundamentals — The methodology behind penetration testing: scoping, rules of engagement, reconnaissance, and the structure that makes engagements repeatable and professional.
• Phishing Basics — Understand and execute phishing campaigns using the Social-Engineer Toolkit.
• Phishing - Merry Clickmas — A hands-on phishing campaign challenge with a realistic target environment.
• Phishing: HiddenEye — Build phishing pages with HiddenEye to capture credentials in simulated social engineering scenarios.
• Writing Pentest Reports — The most underrated skill in offensive security. Learn how to communicate findings clearly and professionally — and turn a great engagement into a great deliverable.

Ready to start your red team journey?

Every red team skill starts with a single room. Pick one from the list above and open it now, no setup, no downloads, no lab required.

Frequently asked questions

Are all these rooms really free? Yes. Every room listed in this guide is free to access with a TryHackMe account. No credit card required.

Do I need prior experience to get started? No. If you're new to offensive security, start with the Basics & Fundamentals section. Those rooms assume no prior knowledge. If you already have experience, jump straight to the skill area you want to develop.

How long will it take to complete all 70+ rooms? It depends on how much time you put in and how deep you go with each room. Budget one to three hours per room on average. Training consistently, you can work through the full list in a few months.

What's the difference between red teaming and penetration testing? Penetration testing is a time-boxed technical exercise to find and report vulnerabilities. Red teaming is a broader adversary simulation, it includes OPSEC, physical security, social engineering, and long-term persistence, not just technical exploitation. Many of the skills overlap, but red teaming goes further in scope and realism.