# PT2 (Penetration Tester Level 2) Study Path

> Free study path mapping HackIndex content to the TryHackMe PT2 exam domains: advanced web attacks, LLM exploitation, vulnerability chaining, container escape, AD trust abuse, NTLM relay, cloud security bypass, and fileless post-exploitation.

- **URL:** https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path
- **Vendor:** TryHackMe
- **Code:** PT2
- **Difficulty:** Advanced
- **Exam duration:** 72 hours (hands-on work and reporting combined)
- **Exam format:** Online, non-proctored, fully hands-on, start anytime
- **Exam machines:** 10 in a single VPN-reached network instance
- **Exam sections:** 2 live simultaneously: Modern Infrastructure Attacks (5 machines, 6 flags) and Active Directory Attacks (5 machines, 5 flags)
- **Exam scoring:** 1000 points; per flag 70% capture, 20% attack description, 10% remediation
- **Exam passing score:** 740 / 1000 (74%)
- **Exam topics:** Web, AI/LLM, containers, cloud IAM, privilege escalation, multi-domain Active Directory
- **Exam retakes:** 1 free retake on a fresh instance with fresh flags; additional retakes paid
- **Exam requirements:** Valid ID or passport, plus a front-facing camera for the selfie check
- **Exam validity:** 3 years (Credly badge and verifiable certificate)
- **Exam certification:** PT2 (Penetration Tester Level 2), TryHackMe
- **Practice machines:** https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/machines.md
- **Published:** 2026-10-04
- **Updated:** 2026-10-04

## Prepare for the PT2 Exam with Free, Hands-On Study Material

The TryHackMe PT2 (Penetration Tester Level 2) certification validates advanced offensive skills across modern attack surfaces: hardened web applications, LLM-powered features, container and cloud infrastructure, and mature Active Directory environments. The exam is practical: candidates compromise targets using chained vulnerabilities, forest-wide AD attacks, and fileless post-exploitation techniques that evade endpoint protection.

This free study path maps HackIndex articles to each PT2 subject area. It does not replace the official TryHackMe PT2 preparation material or any practice room. It gives you a free, searchable command reference for the exam domains, with working payloads and realistic sample output on every topic the exam tests.

Work each module in order or jump straight to the areas you are weakest in. If you can execute each technique end-to-end on a practice target using only the commands on these pages, you have the depth the exam expects.

HackIndex and this study path are independent of TryHackMe. "PT2" and "Penetration Tester Level 2" are referenced only to identify the exam this content maps to.

> [!WARNING]
> This is still a work in progress. The modules still need to be set up and finished.

## Modules

- [Introduction & PT2 Workflow](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/introduction-and-pt2-workflow.md): How PT2 exam domains map to HackIndex content, what the exam actually tests, and how to work through this study path end-to-end.
- [Authentication Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/authentication-attacks.md): Reach past the login screen through user enumeration, credential attacks, session hijacking, JWT forgery, OAuth flow abuse, and MFA bypass. End with chaining auth primitives into account takeover.
- [Advanced Server-Side Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/advanced-server-side-attacks.md): SSRF to cloud metadata, deserialization gadget chains, path traversal and file inclusion, race condition exploitation, and prototype pollution to RCE.
- [Attacking LLMs](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/attacking-llms.md): Discover LLM endpoints, inject into prompts, bypass safety filters, extract system prompts, poison RAG knowledge bases, and abuse agent tools to reach the host.
- [Chaining Vulnerabilities](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/chaining-vulnerabilities.md): Combine low-severity findings into critical compromise through methodology, business-logic abuse, and source-code review to spot gadget chains.
- [Container Security & Escape](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/container-security-and-escape.md): Enumerate exposed Docker APIs, abuse unauthenticated access, and escape containers through mounted sockets, privileged flags, and host namespace sharing.
- [Active Directory Fundamentals](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/active-directory-fundamentals.md): Breach initial AD access through unauthenticated enumeration and spraying, map the domain with LDAP and BloodHound, then move laterally via PtH, PtT, and remote execution.
- [AD Exploitation & Persistence](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ad-exploitation-and-persistence.md): Map privilege paths with BloodHound, roast tickets, abuse ACLs to DCSync, dump NTDS, forge golden/silver tickets, and persist across the domain.
- [AD Trusts & Forest Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ad-trusts-and-forest-attacks.md): Forest is the real security boundary. Escalate from child-domain DA to Enterprise Admin via SID history, trust-key forgery, and cross-forest Kerberoasting.
- [NTLM Relay, ADCS & SQL Server Trust](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ntlm-relay-adcs-and-sql-server-trust.md): Coerce authentication, relay to SMB or LDAP for RBCD, abuse ADCS ESC8 for certificate takeover, and pivot MSSQL instances via linked-server trust.
- [SSH & Linux Lateral Movement](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ssh-and-linux-lateral-movement.md): Authenticate, hijack forwarded agents, escape ForceCommand shells, chain tunnels, and pivot through harvested keys across Linux infrastructure.
- [Cloud Security Bypass](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/cloud-security-bypass.md): Enumerate AWS IAM, steal credentials via SSRF to IMDS, escalate through PassRole plus Lambda, and abuse OIDC federation to assume roles from outside the account.
- [Fileless Attacks & Evasion](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/fileless-attacks-and-evasion.md): Enumerate EDR and AMSI, execute PowerShell in memory, abuse LOLBins and WMI subscriptions, pivot with named-pipe lateral movement, and inject into trusted processes.

> [!NOTE]
> HackIndex is not affiliated with, authorized, endorsed by, or sponsored by TryHackMe Ltd. TryHackMe, PT2, and Penetration Tester Level 2 are trademarks of their respective owner, used here nominatively for identification only. This study path uses only original HackIndex content and links to TryHackMe's official pages as the authoritative source.