Challenges
48 challenges · 9 stages · 3 platforms
- Heads up: you may need to be logged in to each platform for challenge links to open the right page.
- TryHackMe changes which rooms are free all the time. If a room needs a subscription, look out for an upcoming event!
Platforms
- Beginner friendlyCyLabsFree, beginner-friendly CTF challenges and learning paths from Carnegie Mellon University's CyLab Security Academy, formerly picoCTF. A good first stop if you have never done a CTF. (opens in a new tab)
- Beginner to intermediateTryHackMeGuided rooms that teach a topic step by step in a browser-based lab. A good bridge between first CTFs and full machines. (opens in a new tab)
- Beginner to advancedHack The BoxFull vulnerable machines to break into, from easy to very hard. See the machines we recommend on this page. (opens in a new tab)
Stage 01Fundamentals5 challenges
Get comfortable on the Linux command line and solve your first flags. Everything after this assumes you can move around a terminal.
- TryHackMeEasyLinux Fundamentals 1Navigating the Linux command line (opens in a new tab)
- TryHackMeEasyLinux Fundamentals 2SSH, file permissions and system files (opens in a new tab)
- TryHackMeEasyLinux Fundamentals 3Text editors, downloading files, processes and cron (opens in a new tab)
- CyLabsEasyObedient CatReading a flag from a file (opens in a new tab)
- CyLabsEasyWave a flagRunning a program and reading its help (opens in a new tab)
Stage 02Web5 challenges
Learn how HTTP, cookies and web apps work, and how to intercept traffic with Burp Suite. Most machines are broken into through a website.
- TryHackMeEasyHTTP in DetailRequests, responses, headers and cookies (opens in a new tab)
- CyLabsEasyGET aHEADHTTP request methods (opens in a new tab)
- CyLabsEasyCookiesTampering with session cookies (opens in a new tab)
- TryHackMeEasyBurp Suite: The BasicsIntercepting web traffic (opens in a new tab)
- TryHackMeEasyOWASP Top 10The most common web vulnerabilities (opens in a new tab)
Stage 03Cryptography3 challenges
Classic ciphers and hash cracking. You will crack recovered password hashes on almost every machine later on.
Stage 04Forensics3 challenges
Files, metadata and packet captures. Teaches you to look closely at what a system leaves behind.
Stage 05Network Tooling2 challenges
Scanning and enumerating services with Nmap, the first step of every boot2root machine.
Stage 06First Linux Machines8 challenges
Your first boot2root boxes: scan, find the weak service or web app, get a shell. Ordered from most guided to least.
- TryHackMeEasyPickle RickWeb enumeration and command injection (opens in a new tab)
- TryHackMeEasyRootMeFile upload to shell, SUID root (opens in a new tab)
- TryHackMeEasyBasic PentestingSMB enumeration, brute forcing, SSH keys (opens in a new tab)
- TryHackMeEasySimple CTFPublic exploit for a CMS, sudo escalation (opens in a new tab)
- Hack The BoxEasyLameVulnerable network service, straight to root (opens in a new tab)
- Hack The BoxEasyBashedWeb enumeration, exposed web shell, sudo (opens in a new tab)
- Hack The BoxEasyShockerCGI scripts, Shellshock (opens in a new tab)
- Hack The BoxEasyNibblesWeb enumeration, CMS file upload (opens in a new tab)
Stage 07Linux Privilege Escalation6 challenges
From a low-privileged shell to root: sudo rules, SUID binaries, scheduled jobs and leaked secrets.
- TryHackMeEasyKenobiSamba and ProFTPD, PATH variable abuse (opens in a new tab)
- TryHackMeMediumLinux PrivEscCommon privilege escalation paths (opens in a new tab)
- Hack The BoxEasyIrkedSUID binaries (opens in a new tab)
- Hack The BoxEasyValentineHeartbleed, exposed sessions (opens in a new tab)
- Hack The BoxEasySundayWeak credentials, sudo rules (opens in a new tab)
- Hack The BoxMediumPopcornFile upload bypass, kernel exploit (opens in a new tab)
Stage 08Windows Machines11 challenges
The same workflow on Windows: SMB, IIS and file servers, then escalating to SYSTEM.
- TryHackMeEasyBlueEternalBlue with Metasploit, guided (opens in a new tab)
- TryHackMeEasySteel MountainVulnerable file server, PowerUp escalation (opens in a new tab)
- TryHackMeEasyAlfredJenkins to shell, token impersonation (opens in a new tab)
- Hack The BoxEasyLegacySMB exploit (opens in a new tab)
- Hack The BoxEasyBlueSMB exploit, EternalBlue (opens in a new tab)
- Hack The BoxEasyJerryTomcat default credentials (opens in a new tab)
- Hack The BoxEasyDevelFTP upload to web root, kernel exploit (opens in a new tab)
- Hack The BoxEasyOptimumVulnerable file server, kernel exploit (opens in a new tab)
- Hack The BoxEasyGrandpaOld IIS, WebDAV (opens in a new tab)
- Hack The BoxEasyBastionSMB shares, backup images (opens in a new tab)
- TryHackMeMediumWindows Privilege EscalationCommon Windows misconfigurations (opens in a new tab)
Stage 09Active Directory5 challenges
The most advanced stage. Attacking Windows domains with Kerberos, AD permissions and password attacks.
- TryHackMeMediumAttacktive DirectoryEnumerating and attacking a domain (opens in a new tab)
- Hack The BoxEasyActiveGroup Policy passwords, Kerberoasting (opens in a new tab)
- Hack The BoxEasySaunaUser enumeration, AS-REP roasting (opens in a new tab)
- Hack The BoxEasyForestAS-REP roasting, AD permissions (opens in a new tab)
- Hack The BoxMediumResolutePassword spraying, group privileges (opens in a new tab)