I recently completed the TryHackMe Pentest 1 (PT1) certification. I submitted the exam at around 47 hours in, after roughly 16 hours a day over two days. The experience was hands-on and task-driven, which is exactly how I learn best.
Approach and methodology
I followed a structured penetration testing methodology that mirrors real engagement flow:
- Reconnaissance and enumeration
- Vulnerability identification
- Exploitation
- Privilege escalation
- Post-exploitation validation
- Reporting and documentation
Web application testing focus
Web testing emphasized understanding how applications are intended to behave, then validating what happens when inputs change or trust assumptions break.
- Endpoint discovery and parameter mapping
- Input validation and access control checks
- Session and token handling review
- Workflow logic testing for edge cases
Network testing focus
The network portion was about discovery, service identification, and safe validation of common weaknesses in Linux environments.
- Service enumeration and version discovery
- Attack surface mapping and prioritization
- Post-exploitation validation and cleanup mindset
Active Directory testing focus
This section required a different mindset. It was less about one big exploit and more about chaining small misconfigurations.
- Domain enumeration and trust relationships
- Credential hygiene and lateral movement awareness
- Privilege pathways and access graph thinking
Key Takeaways
- Methodical enumeration beats rushing into exploitation.
- Most wins come from small misconfigurations, not flashy exploits.
- Reporting quality matters as much as technical skill.
What I would improve next
My biggest improvement area is keeping even tighter notes on commands and repeatable steps, so I can quickly reproduce findings and build cleaner reports.
Final thoughts
PT1 was one of the most practical training experiences I have completed. It reinforced the value of structured methodology, careful validation, and clear reporting. Most importantly, it sharpened the exact skills I want to use in real-world security work.