A CTF is just a system with a flag hidden somewhere inside it, and your job is to find a legitimate way in and grab it. That's it, that's the whole premise, and it's a far better teacher than any slide deck. You don't need prior experience to start, you need a machine, a bit of stubbornness, and six rooms in the right order. Here they are.
What you're actually building
Four skills come up in almost every CTF you'll ever touch, so get comfortable with them early. Network scanning and enumeration, mapping out what's actually running on a target with tools like Nmap before you try to break anything. Web application testing, poking at the same flaws OWASP has been cataloguing for years. Linux command line proficiency, navigating a filesystem and escalating privilege once you're in. And the one nobody puts in a syllabus: problem-solving under pressure, staying calm when the obvious approach doesn't work and you have to think sideways instead.
Six rooms, worked in order
1. Start with Basic Pentesting. Everything here is foundational on purpose, service enumeration, brute forcing, cracking a hash you've pulled off the box. Nothing clever, nothing tricky, just the core moves you'll reuse in literally everything that follows. Get comfortable here before you go anywhere else.
2. Move to Simple CTF. Same fundamentals, one added wrinkle, you're hunting for credentials hiding in places a beginner wouldn't think to check. It's a lesson in thoroughness disguised as an easy room.
3. Take on Bounty Hacker. This is where sudo misconfigurations stop being a textbook concept and start being something you've actually exploited yourself. Scan, get a foothold, then find the one command a careless admin left runnable as root.
4. Try RootMe. The name is doing some cheeky foreshadowing. You'll bypass a file upload filter to get code execution on a web server, then climb from that low-privilege shell to root. It's the first room on this list where the web app itself, not just the underlying box, is the actual target.
5. Have some fun with Pickle Rick. Rick and Morty themed, genuinely funny if you're into the show, and underneath the jokes is a proper lesson in command injection, finding the one input field that lets you smuggle your own commands into someone else's application. It's the room most people remember first when they talk about starting out.
6. Finish with LazyAdmin. By now you're combining everything, directory discovery to find what's hidden, exploiting a vulnerable CMS to get in, then working your way to root. It's the closest thing on this list to a real-world engagement compressed into 45 minutes.
Clear all six and you haven't just collected six flags, you've built the actual muscle memory the rest of this field runs on.
Making it stick
Resist the urge to jump to the hardest room you can find, difficulty should climb one notch at a time, not ten. Write down what you did and why, even a rough note, because six months from now that's the record that proves you can actually do this. Get into the TryHackMe Discord, other people stuck on the exact same step is oddly motivating. Show up consistently rather than in one exhausting weekend binge, this sticks better in small regular doses. And use hints when you're stuck. A hint isn't cheating, it's the difference between learning something and just sitting there frustrated for an hour.
Where this leads
Six rooms in, you're not done, you're just warmed up. Pre Security and Cyber Security 101 turn what you just did instinctively into a structured foundation, and both build toward genuinely affordable, fully practical certifications, SEC0 and SEC1. From there, if the offensive side is what hooked you, Jr Penetration Tester builds toward PT1. If you found yourself more curious about what the defenders were doing while you attacked, SOC Level 1 builds toward SAL1 instead. Either way, the six rooms above already told you more about which one fits than any quiz could.
Shivam Kumar Singh