You open a TryHackMe room, skim the description, and start firing off scans. Two hours later you're stuck on the third question, the hint button is looking tempting, and you can't remember whether you already tried that directory. That doesn't mean you're bad at this. It usually means you skipped something experienced players never skip.

Enumeration: Stopping at the First Scan

The most common mistake is treating one scan as "recon done." You run nmap with the defaults, see port 22 and port 80, and immediately start poking at the web server. Maybe that's all there is. Or maybe there's a service on 8080 or 31337 that your scan missed because it sits outside the top 1000 ports.

Habits that pay off immediately:

• Run a full TCP sweep at least once: nmap -p- -T4 against the target.
• Follow up with version and default-script detection on whatever is open, for example nmap -sC -sV -p 22,80,8080.
• Enumerate the web application, not just the port. Check robots.txt, page source, cookies, and odd response headers.
• Brute-force directories with a sensible wordlist, then repeat with extensions if the site uses them, such as -x php,txt,html.
• Look for virtual hosts. If the room gives you a domain, add it to /etc/hosts and try obvious subdomains.
• Re-enumerate after you find credentials. A login you just cracked can open a service you dismissed an hour ago.

That last point matters more than any flag. Enumeration isn't a phase you finish and move past. It's something you return to every time you learn one new thing about the machine.

Taking Notes in Your Head

You will forget the one command that worked. It happens right around the point where you're three tabs deep into a writeup and forty minutes have vanished.

Keep one file per room open the entire time. Something this plain is enough:

• Target IP and hostname
• Open ports with versions, and where each scan output lives
• Credentials and hashes, where you found them, and whether they worked
• Directories, files, and paths worth revisiting
• The exact commands that produced a result, pasted verbatim
• Screenshots of anything visual: the web page, a config file, a flag

Paste raw output rather than your summary of it. Weeks later you'll want the port number and the exact flag syntax, not "found a web server." Keep a separate scratch section for dead ends, so you stop retrying the same broken idea every twenty minutes. And the moment something works, save it — terminal scrollback dies at the worst possible time.

Ignoring What the Room Is Telling You

Room questions are not just grading. They're a map. The order of the questions usually mirrors the intended path through the box, which is why the first question is almost always about a port or a service version.

Read the tags and difficulty too. If a room is tagged for web and privilege escalation, an hour spent on the SMB share is an hour you didn't have to lose. Names and descriptions often contain clues, and the credentials the room hands you at the start are rarely decoys. Beginners assume the obvious stuff is a trap. Usually it's the foothold.

Slow down on the task text as well. A surprising number of stuck moments come from answering a subtly different question than the one being asked.

Falling Down Rabbit Holes

A rabbit hole isn't wasted time. Refusing to climb out of one is.

The familiar ones: an old-looking service version that turns out to be a patched build, a public exploit that needs a configuration the target doesn't have, brute-forcing a login when the password is sitting in a comment in the page source, and building an elaborate chain when the room simply wants an unrestricted file upload. Each of these feels like progress because you're typing a lot.

A rule that works: if fifteen minutes pass with no new information, change your approach rather than your effort. Write one line about why the path failed — "SMB needs credentials we don't have yet" — and move on. That line is often the thing that makes the next idea obvious.

Privilege Escalation: Running the Script, Skipping the Thinking

Automated enumeration scripts are useful and also the reason many beginners stall on the final question. They dump a hundred screens of output, scroll to the bottom, and feel lost.

Check the cheap wins first

Before reaching for any tool, run the commands that take seconds:

• sudo -l, to see what this user can run as root without a password
• id and the group list, looking for anything unusual like docker or lxd
• find / -perm -4000 -type f 2>/dev/null for SUID binaries, cross-checked against GTFOBins
• getcap -r / 2>/dev/null for capabilities, which people forget entirely
• crontab -l and ls -la /etc/cron*, plus writable scripts those jobs call
• Home directories, /tmp, /opt, backups, and config files holding plaintext passwords

Most beginner-friendly rooms hide the escalation in one of those. Check them before you automate anything.

Read the output, don't just collect it

When you do run an enumeration script, scan for highlights first: red and yellow lines, credentials, SUID entries, writable service files. Then ask why each one matters. Understanding why a passwordless sudo entry for a text editor gives you a shell is worth more than the shell itself, because you'll recognise the same pattern in a different costume next week.

One caution: kernel exploits are the least reliable route. They can panic the machine, and plenty of targets are simply not vulnerable that way. Try misconfigurations first. They're faster, cleaner, and won't crash the box you've spent an hour on.

Reaching for a Walkthrough Too Early

Searching for a writeup the moment you get stuck turns practice into reading. If you're going to look, set a rule. Work for thirty minutes, write down two things you tried and what each one ruled out, then read the first step of a walkthrough and stop there.

Better still, after finishing a room, close everything and rebuild the path from your own notes. If you can't, the room taught you less than the completion banner suggests. And when you do follow a writeup, type the commands yourself, read the flags, and change one small thing to see what happens. That's where the learning hides.

A Workflow You Can Reuse

Rooms get easier when you run the same loop every single time:

1. Read the task text, tags, and difficulty before you scan anything.
2. Enumerate fully, then enumerate the services, not just the ports.
3. Write everything down: ports, credentials, paths, commands, dead ends.
4. Take the simplest path first — default credentials, misconfigurations, obvious uploads.
5. For privilege escalation, check sudo, SUID, capabilities, and cron before automating.
6. Document as you go, so the writeup writes itself at the end.

None of it is glamorous. It is, however, the difference between finishing a room in an hour and still staring at a scan at midnight. Slow down, read the output properly, and keep your notes open.

Photo: nattanan23 / Pixabay