Skip to content
HackIndex.io

Free study path · TryHackMe

PT2 (Penetration Tester Level 2) Study Path

Free study path mapping HackIndex content to the TryHackMe PT2 exam domains: advanced web attacks, LLM exploitation, vulnerability chaining, container escape, AD trust abuse, NTLM relay, cloud security bypass, and fileless post-exploitation.

Modules
13
Resources
183
Study time
~124 h
Difficulty
Advanced

Exam at a glance

Duration
72 hours (hands-on work and reporting combined)
Format
Online, non-proctored, fully hands-on, start anytime
Machines
10 in a single VPN-reached network instance
Sections
2 live simultaneously: Modern Infrastructure Attacks (5 machines, 6 flags) and Active Directory Attacks (5 machines, 5 flags)
Scoring
1000 points; per flag 70% capture, 20% attack description, 10% remediation
Passing score
740 / 1000 (74%)
Topics
Web, AI/LLM, containers, cloud IAM, privilege escalation, multi-domain Active Directory
Retakes
1 free retake on a fresh instance with fresh flags; additional retakes paid
Requirements
Valid ID or passport, plus a front-facing camera for the selfie check
Validity
3 years (Credly badge and verifiable certificate)
Certification
PT2 (Penetration Tester Level 2), TryHackMe

Prepare for the PT2 Exam with Free, Hands-On Study Material

The TryHackMe PT2 (Penetration Tester Level 2) certification validates advanced offensive skills across modern attack surfaces: hardened web applications, LLM-powered features, container and cloud infrastructure, and mature Active Directory environments. The exam is practical: candidates compromise targets using chained vulnerabilities, forest-wide AD attacks, and fileless post-exploitation techniques that evade endpoint protection.

This free study path maps HackIndex articles to each PT2 subject area. It does not replace the official TryHackMe PT2 preparation material or any practice room. It gives you a free, searchable command reference for the exam domains, with working payloads and realistic sample output on every topic the exam tests.

Work each module in order or jump straight to the areas you are weakest in. If you can execute each technique end-to-end on a practice target using only the commands on these pages, you have the depth the exam expects.

HackIndex and this study path are independent of TryHackMe. "PT2" and "Penetration Tester Level 2" are referenced only to identify the exam this content maps to.

Syllabus modules

Work through the modules in order. Each one explains the topic and links the content worth your time.

  1. 1

    Introduction & PT2 Workflow

    How PT2 exam domains map to HackIndex content, what the exam actually tests, and how to work through this study path end-to-end.

    No resources yet ~8 h

  2. 2

    Authentication Attacks

    Reach past the login screen through user enumeration, credential attacks, session hijacking, JWT forgery, OAuth flow abuse, and MFA bypass. End with chaining auth primitives into account takeover.

    15 resources

  3. 3

    Advanced Server-Side Attacks

    SSRF to cloud metadata, deserialization gadget chains, path traversal and file inclusion, race condition exploitation, and prototype pollution to RCE.

    18 resources ~12 h

  4. 4

    Attacking LLMs

    Discover LLM endpoints, inject into prompts, bypass safety filters, extract system prompts, poison RAG knowledge bases, and abuse agent tools to reach the host.

    16 resources ~10 h

  5. 5

    Chaining Vulnerabilities

    Combine low-severity findings into critical compromise through methodology, business-logic abuse, and source-code review to spot gadget chains.

    11 resources ~8 h

  6. 6

    Container Security & Escape

    Enumerate exposed Docker APIs, abuse unauthenticated access, and escape containers through mounted sockets, privileged flags, and host namespace sharing.

    14 resources ~10 h

  7. 7

    Active Directory Fundamentals

    Breach initial AD access through unauthenticated enumeration and spraying, map the domain with LDAP and BloodHound, then move laterally via PtH, PtT, and remote execution.

    18 resources ~12 h

  8. 8

    AD Exploitation & Persistence

    Map privilege paths with BloodHound, roast tickets, abuse ACLs to DCSync, dump NTDS, forge golden/silver tickets, and persist across the domain.

    17 resources ~14 h

  9. 9

    AD Trusts & Forest Attacks

    Forest is the real security boundary. Escalate from child-domain DA to Enterprise Admin via SID history, trust-key forgery, and cross-forest Kerberoasting.

    4 resources ~10 h

  10. 10

    NTLM Relay, ADCS & SQL Server Trust

    Coerce authentication, relay to SMB or LDAP for RBCD, abuse ADCS ESC8 for certificate takeover, and pivot MSSQL instances via linked-server trust.

    19 resources ~12 h

  11. 11

    SSH & Linux Lateral Movement

    Authenticate, hijack forwarded agents, escape ForceCommand shells, chain tunnels, and pivot through harvested keys across Linux infrastructure.

    21 resources ~8 h

  12. 12

    Cloud Security Bypass

    Enumerate AWS IAM, steal credentials via SSRF to IMDS, escalate through PassRole plus Lambda, and abuse OIDC federation to assume roles from outside the account.

    16 resources ~10 h

  13. 13

    Fileless Attacks & Evasion

    Enumerate EDR and AMSI, execute PowerShell in memory, abuse LOLBins and WMI subscriptions, pivot with named-pipe lateral movement, and inject into trusted processes.

    14 resources ~10 h

  14. Complete the path

    13 modules to finish. Then test yourself on the practice machines below.

PT2 practice machines 80 machines mapped to the syllabus