{"id":257,"date":"2024-08-08T11:43:48","date_gmt":"2024-08-08T11:43:48","guid":{"rendered":"https:\/\/paradoxa.me\/?p=257"},"modified":"2024-08-27T11:44:33","modified_gmt":"2024-08-27T11:44:33","slug":"jr-penetration-tester-try-hack-me","status":"publish","type":"post","link":"https:\/\/paradoxa.me\/index.php\/2024\/08\/08\/jr-penetration-tester-try-hack-me\/","title":{"rendered":"~ Jr. Penetration Tester – Try Hack Me"},"content":{"rendered":"

Jr. Penetration Tester<\/h1>\n

from Try Hack Me<\/h1>\n

Introduction<\/strong><\/h2>\n

After completing the “Complete Beginner” learning path, I also finished the Pre Security, Introduction to Cyber Security, and Web Fundamentals paths.
\nMany of the rooms in these paths overlapped with the one I had just completed, so it made sense to tackle them next. From there, I decided to pursue the offensive side of cybersecurity by enrolling in the Jr. Penetration Tester path.<\/p>\n

This path guides you from the basics of cybersecurity and penetration testing to more advanced topics and tools. It includes hands-on labs, practical exercises, and theoretical content to provide a well-rounded learning experience.<\/p>\n

The path consists of eight sections and 38 rooms and is marked as an intermediate-level path.<\/p>\n

Section 1: Introduction to Cyber Security<\/h2>\n

This section mirrors the beginning of the Complete Beginner path, so there\u2019s nothing new to cover here.<\/p>\n

Section 2: Introduction to Pentesting<\/h2>\n

A brief section with only two rooms.
\nIt introduces penetration testing ethics and methodologies, such as OWASP, followed by security principles, including the CIA Triad and threat modeling, among others.<\/p>\n

Section 3: Introduction to Web Hacking<\/h2>\n

Section 3 is where we start diving deeper into offensive security. Although still introductory, this section features ten rooms.<\/p>\n

The first room covers tools for examining web applications, such as Inspector and Debugger.
\nThe second room focuses on manual content discovery (ranging from file .txt to HTTP headers) and OSINT research.<\/p>\n

The third room we have an introduction of subdomain enumeration.<\/p>\n

In the fourth room, we explore methodologies like brute forcing and cookie tampering.<\/p>\n

The next couple of rooms cover Insecure Direct Object Reference (IDOR) and Local File Inclusion (LFI).<\/p>\n

Rooms seven and eight provide an introduction to Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS) using payloads.<\/p>\n

The section finally concludes with rooms on site injection and SQL injections, which have been my favorite so far.<\/p>\n

Section 4: Burp Suite<\/h2>\n

This section consists of five rooms, all dedicated to Burp Suite!<\/p>\n

The first room introduces the suite and the FoxyProxy browser extension.
\nRoom two is focused on Repeater, room three on Intruder, and room four covers other tools within the suite (Decoder, Comparer, Sequencer, and Organizer).
\nThe final room discusses Burp Suite extensions and API.<\/p>\n

This was one of my favorite sections as it thoroughly explains Burp Suite and its capabilities.<\/p>\n

Section 5: Network Security<\/h2>\n

Another interesting section.<\/p>\n

We explore reconnaissance in the first couple of rooms, passive reconnaissance in the first and active in the second.<\/p>\n

The following four rooms are completely dedicated to Nmap; which is great as the tool is very useful and powerful for reconnaissance.<\/p>\n

Afterward, we learn about various protocols and how to attack them.<\/p>\n

Finally, the section concludes with a challenge room that tests what we\u2019ve learned.<\/p>\n

Section 6: Vulnerability Research<\/h2>\n

Although a small section, it\u2019s probably the most important.<\/p>\n

In the three rooms, we first learn about vulnerabilities, then how to find and exploit them.<\/p>\n

We also get to put theory into practice in the final room.<\/p>\n

Section 7: Metasploit<\/h2>\n

This section has only three rooms, compared to the more extensive Burp Suite section, but it\u2019s still very interesting.<\/p>\n

The first room provides an overview of Metasploit, while the second and third rooms dive into exploitation and payload creation with Msfvenom, followed by Meterpreter.<\/p>\n

Note: This section was also covered in the Complete Beginner path, but it was good to refresh my memory.<\/p>\n

Section 8: Privilege Escalation<\/h2>\n

The final section of the path includes three very practical rooms that challenge us to apply the knowledge we\u2019ve gained so far on both Linux and Windows plus new ways to enumerate, exploit and escalate privileges inside the target.<\/p>\n

I think is the best way to conclude the path via hands on Labs that cement the concept and provide us whit a better understand on how to go about the target machine.<\/p>\n

Conclusion<\/h2>\n

I really enjoyed this path as it delves into more advanced topics about exploiting targets and what to do after exploitation.<\/p>\n

I can say it\u2019s my favorite path so far! Although it\u2019s specifically designed for red team members, I would recommend it to the blue team as well, as it provides insight into an attacker\u2019s mindset.<\/p>\n

Following this logic, my next path will be SOC Level 1, where I\u2019ll learn how a defensive team frame work operates.<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Jr. Penetration Tester from Try Hack Me Introduction After completing the “Complete Beginner” learning path, I also finished the Pre Security, Introduction to Cyber Security, and Web Fundamentals paths. Many […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":17,"footnotes":""},"categories":[44,38],"tags":[50,40,49,51,48,42],"class_list":["post-257","post","type-post","status-publish","format-standard","hentry","category-tryhackme","category-cybersecurity","tag-burp-suite","tag-cybersecurity","tag-metasploit","tag-nmap","tag-penetration-tester","tag-try-hack-me"],"_links":{"self":[{"href":"https:\/\/paradoxa.me\/index.php\/wp-json\/wp\/v2\/posts\/257","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/paradoxa.me\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/paradoxa.me\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/paradoxa.me\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/paradoxa.me\/index.php\/wp-json\/wp\/v2\/comments?post=257"}],"version-history":[{"count":1,"href":"https:\/\/paradoxa.me\/index.php\/wp-json\/wp\/v2\/posts\/257\/revisions"}],"predecessor-version":[{"id":258,"href":"https:\/\/paradoxa.me\/index.php\/wp-json\/wp\/v2\/posts\/257\/revisions\/258"}],"wp:attachment":[{"href":"https:\/\/paradoxa.me\/index.php\/wp-json\/wp\/v2\/media?parent=257"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/paradoxa.me\/index.php\/wp-json\/wp\/v2\/categories?post=257"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/paradoxa.me\/index.php\/wp-json\/wp\/v2\/tags?post=257"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}