Guided Pentest: Web | TryHackMe

Imagine you have been hired as a penetration tester. Your client runs a small web application called RecruitX, an internal recruitment portal where hiring managers post job listings, candidates submit applications, and administrators manage the entire workflow. The client suspects the application has security issues, but does not know where. Your job is to find out.

This room will guide you through a realistic web application penetration test from start to finish. You will not be dropped into a machine and told to "find the flags." Instead, each task walks you through a phase of the engagement, explaining what to do, why you are doing it, and what to look for. By the end, you will have moved from knowing nothing about the target to achieving remote code execution on the underlying server.

Learning Objectives

The engagement follows this path:

1. Reconnaissance and enumeration — Discover what the application exposes
2. Insecure Direct Object Reference (IDOR) — Access data belonging to other users
3. Weak password reset — Take over an account through a flawed reset mechanism
4. Admin panel access — Escalate from a regular user to an administrator
5. Remote code execution — Leverage admin functionality to execute commands on the server

Each vulnerability builds on the information gathered in the previous step. This is how real-world penetration tests work; you rarely find a single critical flaw sitting in the open. Instead, you chain smaller weaknesses together until they add up to something significant.

Prerequisites

• Linux CLI Basics
• HTTP in Detail
• Web Application Basics

Connecting to the Machine

Click the Start Machine below, and the target machine will be accessible at MACHINE_IP. The RecruitX application runs on port 80. Give the machine two minutes to fully boot before beginning.

You will also need the AttackBox or your own machine connected to the TryHackMe VPN. If you are using the AttackBox, click Start AttackBox below to start it.

Answer the questions below

• What version of the Apache server is running?

2.4.58

• What database service is running on the target?

MySQL

• What is the path to the password reset page?

/reset.php

• What is the name of the administrator user

Sarah Mitchell

• What role does James Crawford hold?

hiring_manager

• How many digits long is the reset token?

6

• After resetting the password for s.mitchell@recruitx.thm and logging in, what role is displayed for that account in the dashboard?

Administrator

• What is the name of the PHP file responsible for handling file upload in the RecruitX web app?

upload.php

• What HTML attribute on the file input is used to restrict selectable file extensions on the client side?

accept

• Which alternative PHP extension bypassed the upload filter?

.phtml

• What user is the web shell running as?

www-data

• What is the hostname of the target server?

recruitx-prod

• What is the flag?

THM{ch41n3d_vulns_4r3_d3v4st4t1ng}

• How many distinct vulnerabilities were chained together in this engagement?

4

• What approach should be used instead of a blocklist when validating file uploads?

allowlist

CONCLUSION

In this room, we walked through a complete web application penetration test, from the initial Nmap scan to remote code execution on the underlying server. Along the way, you practised the mindset that separates a good penetration tester from a great one: patience, observation, and the ability to connect findings across different parts of an application.

Let's recap the key lessons from this engagement:

Enumeration is everything. The vulnerabilities we exploited were discoverable because we took the time to map the application's structure, headers, endpoints, and behaviour before attempting exploitation.

Small flaws chain into big compromises. No single issue here was exotic or particularly complex. IDOR, weak password resets, and upload bypasses are well-understood vulnerabilities. Their impact came from how they connected to each other.

Client-side restrictions are not security. The file upload form used an accept attribute to restrict file types in the browser. The server-side check used a blocklist that missed alternative PHP extensions. Real security requires server-side validation with an allowlist approach.

Password reset mechanisms deserve careful attention. They are complex to implement securely, and a single design flaw, like exposing the token in the response, can lead to account takeover.

Think like an attacker, report like a consultant. Finding the vulnerabilities is half the job. Documenting them clearly with severity ratings and actionable remediation advice is what makes the engagement valuable to the client.

You have completed the guided pentest. It is time to apply what you have learned to the upcoming challenges.

Answer the questions below

I have successfully completed the room.