Blog
Blog > Blog

What Rooms Should You Do? A Free Guide for Beginners

If you're trialling out the Cyber Security industry and looking for a free version of TryHackMe, here is a guide to beginner pathways.

Bee
Bee
Dec 14, 2020 • 7 min read

You want to start learning with TryHackMe, but perhaps you don't want to pay for a subscription. This means you will not get access to paths, which are a guided series of rooms to take you from not knowing something to knowing something.

This blog post will detail a free path we have created for you, taking you from a beginner to a medium level. This will be for an offensive pentesting path, but some rooms will feature blue teaming too. (Red teaming is offensive, blue teaming is defensive.)

Note: This is a community provided path featuring free rooms only. For the best experience, with a path made for you with premium rooms please subscribe.

Please scroll down to the end to get a Markdown version, so you can use this in your personal notes.

Note: If you have any concerns with these rooms or want to add more, DM on Twitter. I'm Bee 👋

Introduction

This blog post is split into multiple levels, each one aiming to teach you one part. You can skip levels if you'd like, but they are all essential to a hackers mindset.

Rooms on TryHackMe are broken into two types:

  • Walkthroughs

They walk you through the problem domain and teach you the skills required.

  • Challenge (CTF)

You are given a machine and you have to hack into it, without any help.

You are allowed to look at walkthroughs for challenge CTFs, however, try to only read what is necessary if you get stuck. And only read the walkthrough if you are really stuck.

If you would like a hint without reading a walkthrough, you can ask on our Discord, Subreddit or Forums.

Level 1 - Intro

The absolute bare minimum you should know before doing any CTFs.

Here are some introductory style capture the flag (challenge) like rooms to help you out. These are classed on the site as walkthroughs other than OHsint, however, they feature a lot of challenges that can introduce one to the world of challenge rooms.

Level 2 - Tooling

The most important thing in a pentester's toolbox, tooling. This section aims to teach you the absolute minimum of neccesary tools to make you a better hacker.

Again, here are some more introductory CTFs. These are a little harder but with your new knowledge of tools, you should smash them in no time. Don't worry if you can't, that's what hacking is all about – trying harder until you can no longer try and then learning from what you couldn't do.

Level 3 - Crypto & Hashes with CTF practice

Understanding cryptography is essential to any hacker. This section will teach you the basics and give you some CTF practice.

Level 4 - Web

Level 5 - Reverse Engineering

Reverse engineering is the art of taking a compiled program and figuring out what it does. This section will teach you everything you need to know about it.

Level 6 - Networking

Level 7 - Privilege Escalation

Privilege Escalation is where you take a user account and get root / domain admin. It is essential to CTFs and hacking, so let's learn more about how to do it.

Level 8 - CTF practice

Here's some CTF practice for you.

Level 9 - Windows

And finally, Windows practice! Note that Windows machines physically cost more resources to run, so most of the Windows machines are locked behind a subscription.

Markdown Version

Use this in your own notes to easily keep track.

I suggest this key:

  • 👍 = Completed.
  • ⏳ = In progress.
  • 🔴 = Stopped, depends on other tasks, depends on knowledge from other rooms.
# Level 1 - Intro
- [ ] OpenVPN https://tryhackme.com/room/openvpn
- [ ] Welcome https://tryhackme.com/jr/welcome
- [ ] Intro to Researching https://tryhackme.com/room/introtoresearch
- [ ] The Hacker Methodology https://tryhackme.com/room/hackermethodology
- [ ] Learn Linux https://tryhackme.com/module/linux-fundamentals
- [ ] Crash Course Pentesting https://tryhackme.com/room/ccpentesting

**Introductory CTFs to get your feet wet**

- [ ] Google Dorking https://tryhackme.com/room/googledorking
- [ ] OHsint https://tryhackme.com/room/ohsint
- [ ] Shodan.io https://tryhackme.com/room/shodan

# Level 2 - Tooling
- [ ] Tmux https://tryhackme.com/room/rptmux
- [ ] Nmap https://tryhackme.com/room/furthernmap
- [ ] Web Scanning https://tryhackme.com/room/rpwebscanning
- [ ] Sublist3r https://tryhackme.com/room/rpsublist3r
- [ ] Metasploit https://tryhackme.com/room/rpmetasploit
- [ ] Hydra https://tryhackme.com/room/hydra
- [ ] Linux Privesc https://tryhackme.com/room/linuxprivesc
- [ ] Web Scanning https://tryhackme.com/room/rpwebscanning
- [ ] Shodan https://tryhackme.com/room/shodan
- [ ] RustScan (I invented RustScan so excuse the self-promo) https://tryhackme.com/room/rustscan

**More introductory CTFs**
- [ ] Vulnversity - https://tryhackme.com/room/vulnversity
- [ ] Blue - https://tryhackme.com/room/blue
- [ ] Simple CTF https://tryhackme.com/room/easyctf
- [ ] Bounty Hacker https://tryhackme.com/room/cowboyhacker
- [ ] Brute It https://tryhackme.com/room/bruteit

# Level 3 - Crypto & Hashes with CTF practice
- [ ] Crack the hash https://tryhackme.com/room/crackthehash
- [ ] Agent Sudo https://tryhackme.com/room/agentsudoctf
- [ ] The Cod Caper https://tryhackme.com/room/thecodcaper
- [ ] Ice https://tryhackme.com/room/ice
- [ ] Lazy Admin https://tryhackme.com/room/lazyadmin
- [ ] Basic Pentesting https://tryhackme.com/room/basicpentestingjt

# Level 4 - Web
- [ ] OWASP top 10 https://tryhackme.com/room/owasptop10
- [ ] Inclusion https://tryhackme.com/room/inclusion
- [ ] Injection https://tryhackme.com/room/injection
- [ ] Vulnversity https://tryhackme.com/room/vulnversity
- [ ] Basic Pentesting https://tryhackme.com/room/basicpentestingjt
- [ ] Juiceshop https://tryhackme.com/room/owaspjuiceshop
- [ ] Ignite https://tryhackme.com/room/ignite
- [ ] Overpass https://tryhackme.com/room/overpass
- [ ] Year of the Rabbit https://tryhackme.com/room/yearoftherabbit
- [ ] DevelPy https://tryhackme.com/room/bsidesgtdevelpy
- [ ] Jack of all trades https://tryhackme.com/room/jackofalltrades
- [ ] Bolt https://tryhackme.com/room/bolt

# Level 5 - Reverse Engineering
- [ ] Intro to x86 64 https://tryhackme.com/room/introtox8664
- [ ] CC Ghidra https://tryhackme.com/room/ccghidra
- [ ] CC Radare2 https://tryhackme.com/room/ccradare2
- [ ] CC Steganography https://tryhackme.com/room/ccstego
- [ ] Reverse Engineering https://tryhackme.com/room/reverseengineering
- [ ] Reversing ELF https://tryhackme.com/room/reverselfiles
- [ ] Dumping Router Firmware https://tryhackme.com/room/rfirmware

# Level 6 - Networking
- [ ] Introduction to Networking https://tryhackme.com/room/introtonetworking
- [ ] Smag Grotto https://tryhackme.com/room/smaggrotto
- [ ] Overpass 2 https://tryhackme.com/room/overpass2hacked

# Level 7 - PrivEsc
- [ ] Sudo Security Bypass https://tryhackme.com/room/sudovulnsbypass
- [ ] Sudo Buffer Overflow https://tryhackme.com/room/sudovulnsbof
- [ ] Windows Privesc Arena https://tryhackme.com/room/windowsprivescarena
- [ ] Linux Privesc Arena https://tryhackme.com/room/linuxprivescarena
- [ ] Windows Privesc https://tryhackme.com/room/windows10privesc
- [ ] Blaster https://tryhackme.com/room/blaster
- [ ] Ignite https://tryhackme.com/room/ignite
- [ ] Kenobi https://tryhackme.com/room/kenobi
- [ ] Capture the flag https://tryhackme.com/room/c4ptur3th3fl4g
- [ ] Pickle Rick https://tryhackme.com/room/picklerick

# Level 8 - CTF practice
- [ ] Post Exploitation Basics https://tryhackme.com/room/postexploit
- [ ] Inclusion https://tryhackme.com/room/inclusion
- [ ] Dogcat https://tryhackme.com/room/dogcat
- [ ] LFI basics https://tryhackme.com/room/lfibasics
- [ ] Buffer Overflow Prep https://tryhackme.com/room/bufferoverflowprep
- [ ] Overpass https://tryhackme.com/room/overpass
- [ ] Break out the cage https://tryhackme.com/room/breakoutthecage1
- [ ] Lian Yu https://tryhackme.com/room/lianyu

# Level 9 - Windows
- [ ] Attacktive Directory https://tryhackme.com/room/attacktivedirectory
- [ ] Retro https://tryhackme.com/room/retro
- [ ] Blue Print https://tryhackme.com/room/blueprint
- [ ] Anthem https://tryhackme.com/room/anthem
- [ ] Relevant https://tryhackme.com/room/relevant

Conclusion

Now you will have a good understanding of hacking, all for free! You should now be able to do the easiest challenges quickly, and medium challenges are where you will now gain the most amount of knowledge.

If you got this far, consider subscribing to unlock even better rooms. Most Windows rooms are subscriber-only because Windows uses more resources than Linux. If you want to learn more Windows pentesting, a subscription is one of the better ways to go about it.

Thanks to CatchUpHackers for writing Zero to Hero, which inspired this article.

What to do next?

Want more guided content but don't want to pay?

Done those? You can:

  • Subscribe to TryHackMe to get paths featuring subscriber-only rooms. Trust me, they are far better than anything I could make!
  • New challenge rooms are released weekly, have a go at them before the writeups come out!
  • Keep a list of interesting CTFs and do them.
  • Sign up to other platforms such as CTF time and take part in competitive CTFs. You'll be surprised by how far you can get with the knowledge you have!
  • Start a blog with writeups of new rooms.
  • Create your own challenge rooms for TryHackMe.
  • Did you like reverse engineering? How about Windows? Or perhaps privesc? You can specialise in one area if you really like it. Just search for rooms with that on TryHackMe, or ask in the Discord/Forums/Sub-reddit "I liked X and want to do more".

Follow me on Twitter if you liked this 👋 https://twitter.com/bee_sec_san

Recommended

Get more insights, news, and assorted awesomeness around cyber training.

Success Story
From Basic Computer Skills To Junior Penetration Tester: Olufela’s Success Story
Olufela went from minimal computer skills to a Junior Penetration Tester following consistent study with TryHackMe. Here's her story!
Business Resource
KPMG
How KPMG Actions Practical Independent Learning That Cyber Analysts Can Directly Transfer to Job Responsibilities
Business Resource
Network Intelligence
How Network Intelligence Revolutionised Training and Onboarding With TryHackMe