# Introduction & PT2 Workflow

> How PT2 exam domains map to HackIndex content, what the exam actually tests, and how to work through this study path end-to-end.

- **URL:** https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/introduction-and-pt2-workflow
- **Certification:** [PT2 (Penetration Tester Level 2) Study Path](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path.md)
- **Estimated study hours:** 8
- **Published:** 2026-10-04
- **Updated:** 2026-10-04

PT2 is a practical exam that tests whether you can compromise modern environments end to end. Not one vulnerability class, not one platform: hardened web applications, LLM-powered features, container and cloud infrastructure, Active Directory environments with trusts between domains and forests, and post-exploitation on hosts protected by endpoint detection. This module explains what the exam actually tests, how HackIndex content maps to each exam domain, and how to use this study path to build the depth each module expects.

## What PT2 Actually Tests

The exam rewards chaining. A low-impact finding on its own becomes critical when combined with two others: an open redirect plus an OAuth flow equals account takeover; SSRF plus a cloud metadata endpoint equals account-wide compromise; child-domain Domain Admin plus an intra-forest trust equals Enterprise Admin across every domain in the forest. Candidates who stop at the first exploitable primitive miss the finding the exam is looking for. The practical modules in this study path mirror that philosophy: each page covers a primitive, and the Chaining Vulnerabilities module teaches how to combine them.

The second thing the exam rewards is depth across modern surfaces that classic penetration-testing certifications barely touch. Prompt injection against LLM-powered features. Container escape via mounted sockets and overly-permissive capabilities. AWS IAM privilege escalation through PassRole and trust-policy misconfiguration. Fileless post-exploitation using PowerShell download cradles, LOLBins, WMI event subscriptions, and process injection to evade endpoint detection. Each gets its own module here.

## How HackIndex Is Organised

Content on HackIndex is organised around two axes: **what you are attacking** and **what phase you are in**. A **service** is a network-facing protocol or application: SSH, SMB, LDAP, MSSQL, HTTP, Kerberos. A **platform** is an operating system or environment: Active Directory, Windows, Linux, AWS. If an attack enters through a specific service, the content lives under that service. If it targets the platform itself (AD trust abuse, Linux kernel exploits, container escape), it lives under the platform.

## Phases And Articles

Within each service or platform, content is grouped by phase: Enumeration, Vulnerability Discovery, Exploitation, Privilege Escalation, Post-Exploitation, Lateral Movement, Persistence. Each article inside a phase covers one specific technique, tool, or attack chain. Commands use placeholder variables (`$TARGET_IP`, `$PORT`, `$USER`, `$DOMAIN`) and realistic sample output where it helps interpretation. Focus is on what to run and how to read the results, not theory.

## Using This Study Path

Each PT2 module page lists the HackIndex services, phases, and articles that cover the same skills the exam domain tests. The goal is not to replace the TryHackMe PT2 preparation material or any practice room. It is to give you a free, searchable command reference for every exam domain, with payloads and sample output on every topic the exam touches.

Start with the modules you are weakest in. If you can execute each technique end-to-end on a practice target using only the commands on these pages, you have the depth the exam expects for that topic. Then move to the Chaining Vulnerabilities module to practise combining primitives into critical findings.

The exam is manual. Automated scanners find primitives, but you need to understand each one well enough to chain findings and write exploits when tools fall short. Memorising command flags is not the goal; understanding what each technique proves and how to compose it with others is.

## Independence And Scope

HackIndex and this study path are independent of TryHackMe. The names "PT2" and "Penetration Tester Level 2" are referenced only to identify the exam this content maps to. No TryHackMe room text, exam material, or lab content is reproduced here. Every command, payload, and sample output on these pages is original HackIndex content.