If you're trialling out the Cyber Security industry and looking for a free version of TryHackMe, here is a guide to beginner pathways.
You want to start learning with TryHackMe, but perhaps you don't want to pay for a subscription. This means you will not get access to paths, which are a guided series of rooms to take you from not knowing something to knowing something.
This blog post will detail a free path we have created for you, taking you from a beginner to a medium level. This will be for an offensive pentesting path, but some rooms will feature blue teaming too. (Red teaming is offensive, blue teaming is defensive.)
Note: This is a community provided path featuring free rooms only. For the best experience, with a path made for you with premium rooms please subscribe.
Please scroll down to the end to get a Markdown version, so you can use this in your personal notes.
Note: If you have any concerns with these rooms or want to add more, DM on Twitter. I'm Bee 👋
This blog post is split into multiple levels, each one aiming to teach you one part. You can skip levels if you'd like, but they are all essential to a hackers mindset.
Rooms on TryHackMe are broken into two types:
They walk you through the problem domain and teach you the skills required.
You are given a machine and you have to hack into it, without any help.
You are allowed to look at walkthroughs for challenge CTFs, however, try to only read what is necessary if you get stuck. And only read the walkthrough if you are really stuck.
If you would like a hint without reading a walkthrough, you can ask on our Discord, Subreddit or Forums.
The absolute bare minimum you should know before doing any CTFs.
Here are some introductory style capture the flag (challenge) like rooms to help you out. These are classed on the site as walkthroughs other than OHsint, however, they feature a lot of challenges that can introduce one to the world of challenge rooms.
The most important thing in a pentester's toolbox, tooling. This section aims to teach you the absolute minimum of neccesary tools to make you a better hacker.
Again, here are some more introductory CTFs. These are a little harder but with your new knowledge of tools, you should smash them in no time. Don't worry if you can't, that's what hacking is all about – trying harder until you can no longer try and then learning from what you couldn't do.
Understanding cryptography is essential to any hacker. This section will teach you the basics and give you some CTF practice.
Reverse engineering is the art of taking a compiled program and figuring out what it does. This section will teach you everything you need to know about it.
Privilege Escalation is where you take a user account and get root / domain admin. It is essential to CTFs and hacking, so let's learn more about how to do it.
Here's some CTF practice for you.
And finally, Windows practice! Note that Windows machines physically cost more resources to run, so most of the Windows machines are locked behind a subscription.
Use this in your own notes to easily keep track.
I suggest this key:
# Level 1 - Intro - [ ] OpenVPN https://tryhackme.com/room/openvpn - [ ] Welcome https://tryhackme.com/jr/welcome - [ ] Intro to Researching https://tryhackme.com/room/introtoresearch - [ ] The Hacker Methodology https://tryhackme.com/room/hackermethodology - [ ] Learn Linux https://tryhackme.com/module/linux-fundamentals - [ ] Crash Course Pentesting https://tryhackme.com/room/ccpentesting **Introductory CTFs to get your feet wet** - [ ] Google Dorking https://tryhackme.com/room/googledorking - [ ] OHsint https://tryhackme.com/room/ohsint - [ ] Shodan.io https://tryhackme.com/room/shodan # Level 2 - Tooling - [ ] Tmux https://tryhackme.com/room/rptmux - [ ] Nmap https://tryhackme.com/room/furthernmap - [ ] Web Scanning https://tryhackme.com/room/rpwebscanning - [ ] Sublist3r https://tryhackme.com/room/rpsublist3r - [ ] Metasploit https://tryhackme.com/room/rpmetasploit - [ ] Hydra https://tryhackme.com/room/hydra - [ ] Linux Privesc https://tryhackme.com/room/linuxprivesc - [ ] Web Scanning https://tryhackme.com/room/rpwebscanning - [ ] Shodan https://tryhackme.com/room/shodan - [ ] RustScan (I invented RustScan so excuse the self-promo) https://tryhackme.com/room/rustscan **More introductory CTFs** - [ ] Vulnversity - https://tryhackme.com/room/vulnversity - [ ] Blue - https://tryhackme.com/room/blue - [ ] Simple CTF https://tryhackme.com/room/easyctf - [ ] Bounty Hacker https://tryhackme.com/room/cowboyhacker - [ ] Brute It https://tryhackme.com/room/bruteit # Level 3 - Crypto & Hashes with CTF practice - [ ] Crack the hash https://tryhackme.com/room/crackthehash - [ ] Agent Sudo https://tryhackme.com/room/agentsudoctf - [ ] The Cod Caper https://tryhackme.com/room/thecodcaper - [ ] Ice https://tryhackme.com/room/ice - [ ] Lazy Admin https://tryhackme.com/room/lazyadmin - [ ] Basic Pentesting https://tryhackme.com/room/basicpentestingjt # Level 4 - Web - [ ] OWASP top 10 https://tryhackme.com/room/owasptop10 - [ ] Inclusion https://tryhackme.com/room/inclusion - [ ] Injection https://tryhackme.com/room/injection - [ ] Vulnversity https://tryhackme.com/room/vulnversity - [ ] Basic Pentesting https://tryhackme.com/room/basicpentestingjt - [ ] Juiceshop https://tryhackme.com/room/owaspjuiceshop - [ ] Ignite https://tryhackme.com/room/ignite - [ ] Overpass https://tryhackme.com/room/overpass - [ ] Year of the Rabbit https://tryhackme.com/room/yearoftherabbit - [ ] DevelPy https://tryhackme.com/room/bsidesgtdevelpy - [ ] Jack of all trades https://tryhackme.com/room/jackofalltrades - [ ] Bolt https://tryhackme.com/room/bolt # Level 5 - Reverse Engineering - [ ] Intro to x86 64 https://tryhackme.com/room/introtox8664 - [ ] CC Ghidra https://tryhackme.com/room/ccghidra - [ ] CC Radare2 https://tryhackme.com/room/ccradare2 - [ ] CC Steganography https://tryhackme.com/room/ccstego - [ ] Reverse Engineering https://tryhackme.com/room/reverseengineering - [ ] Reversing ELF https://tryhackme.com/room/reverselfiles - [ ] Dumping Router Firmware https://tryhackme.com/room/rfirmware # Level 6 - Networking - [ ] Introduction to Networking https://tryhackme.com/room/introtonetworking - [ ] Smag Grotto https://tryhackme.com/room/smaggrotto - [ ] Overpass 2 https://tryhackme.com/room/overpass2hacked # Level 7 - PrivEsc - [ ] Sudo Security Bypass https://tryhackme.com/room/sudovulnsbypass - [ ] Sudo Buffer Overflow https://tryhackme.com/room/sudovulnsbof - [ ] Windows Privesc Arena https://tryhackme.com/room/windowsprivescarena - [ ] Linux Privesc Arena https://tryhackme.com/room/linuxprivescarena - [ ] Windows Privesc https://tryhackme.com/room/windows10privesc - [ ] Blaster https://tryhackme.com/room/blaster - [ ] Ignite https://tryhackme.com/room/ignite - [ ] Kenobi https://tryhackme.com/room/kenobi - [ ] Capture the flag https://tryhackme.com/room/c4ptur3th3fl4g - [ ] Pickle Rick https://tryhackme.com/room/picklerick # Level 8 - CTF practice - [ ] Post Exploitation Basics https://tryhackme.com/room/postexploit - [ ] Inclusion https://tryhackme.com/room/inclusion - [ ] Dogcat https://tryhackme.com/room/dogcat - [ ] LFI basics https://tryhackme.com/room/lfibasics - [ ] Buffer Overflow Prep https://tryhackme.com/room/bufferoverflowprep - [ ] Overpass https://tryhackme.com/room/overpass - [ ] Break out the cage https://tryhackme.com/room/breakoutthecage1 - [ ] Lian Yu https://tryhackme.com/room/lianyu # Level 9 - Windows - [ ] Attacktive Directory https://tryhackme.com/room/attacktivedirectory - [ ] Retro https://tryhackme.com/room/retro - [ ] Blue Print https://tryhackme.com/room/blueprint - [ ] Anthem https://tryhackme.com/room/anthem - [ ] Relevant https://tryhackme.com/room/relevant
Now you will have a good understanding of hacking, all for free! You should now be able to do the easiest challenges quickly, and medium challenges are where you will now gain the most amount of knowledge.
If you got this far, consider subscribing to unlock even better rooms. Most Windows rooms are subscriber-only because Windows uses more resources than Linux. If you want to learn more Windows pentesting, a subscription is one of the better ways to go about it.
Thanks to CatchUpHackers for writing Zero to Hero, which inspired this article.
Want more guided content but don't want to pay?
Done those? You can:
Follow me on Twitter if you liked this 👋 https://twitter.com/bee_sec_san
Get more insights, news, and assorted awesomeness around cyber training.