TryHackMe - Basic Pentesting Walkthrough

Introduction

This tutorial will guide you through the basic pentesting challenge on TryHackMe, focusing on web application hacking and privilege escalation. Whether you're a beginner looking to enhance your skills or someone interested in cybersecurity, this step-by-step walkthrough will provide you with valuable insights and practical advice.

Step 1: Setting Up Your TryHackMe Account

• Visit the TryHackMe website and create an account if you don't have one.
• Verify your email address to activate your account.
• Log in to the platform to access the pentesting challenges.

Step 2: Navigating to the Basic Pentesting Challenge

• Once logged in, use the search bar to find the "Basic Pentesting" challenge.
• Click on the challenge to view its description and objectives.

Step 3: Understanding the Challenge Objectives

• Review the objectives of the challenge, which typically include:
  • Identifying vulnerabilities in web applications.
  • Exploiting those vulnerabilities to gain access.
  • Performing privilege escalation to access restricted areas.
• Familiarize yourself with common web app vulnerabilities such as SQL injection, XSS, and CSRF.

Step 4: Gathering Information

• Use tools like Nmap to perform reconnaissance on the target:
  • Run a command like:

    nmap -sS -sV [target_IP]
    

  • Analyze the output to identify open ports and services running on the target.

Step 5: Scanning for Vulnerabilities

• Utilize vulnerability scanning tools such as OWASP ZAP or Burp Suite.
• Configure the tool to scan the target website for known vulnerabilities.
• Review the scan results for potential attack vectors.

Step 6: Exploiting Vulnerabilities

• Based on the identified vulnerabilities, attempt to exploit them:
  • For SQL injection, use a payload such as:

    ' OR '1'='1
    

  • Test for XSS by injecting scripts into input fields and observing the response.
• Always ensure you have permission to test the application to avoid legal issues.

Step 7: Privilege Escalation

• After gaining access, look for ways to escalate privileges:
  • Check for misconfigurations or weak passwords.
  • Look for sensitive files or configuration settings that may allow further access.

Step 8: Documenting Your Findings

• Keep a detailed log of your process and any vulnerabilities you discovered.
• Document how you exploited each vulnerability and any successful privilege escalations.
• This documentation will be essential for reporting and reflection on your pentesting experience.

Conclusion

Congratulations on completing the basic pentesting challenge! You have gained practical experience in web application hacking and privilege escalation. To further enhance your skills, consider exploring more advanced challenges on TryHackMe or engaging with the cybersecurity community through forums and social networks. Always remember to practice ethical hacking and respect legal boundaries in your learning journey.