A curated collection of machine writeups from Offsec Proving Grounds and TryHackMe, organized using a consistent methodology:
Recon → Scanning → Enumeration → Exploitation → Privilege Escalation → Root/Administrator
pentest-writeups/
├── README.md
├── Offsec-Proving-Grounds/
│ ├── 48 machine writeups
└── TryHackMe/
└── 34 machine writeups
Each writeup follows this standardized format:
| Section | Description |
|---|---|
| 1. Recon | Target info — IP, hostname, OS, credentials found |
| 2. Scanning | Full Nmap output + open ports summary |
| 3. Enumeration | Service-by-service enumeration, web fuzzing, SMB, FTP, etc. |
| 4. Exploitation | Initial foothold — CVEs, default creds, RCE, file upload, etc. |
| 5. Privilege Escalation | Local privesc — SUID, sudo, cron, misconfigs, tokens |
| 6. Root/Administrator | Proof — uid=0(root) or nt authority\system |
48 machines | Platform: Offsec Proving Grounds
34 machines | Platform: TryHackMe
| Platform | Machines |
|---|---|
| Offsec Proving Grounds | 48 |
| TryHackMe | 34 |
| Total | 82 |
Scanning & Recon: nmap · whatweb · curl
Web Fuzzing: gobuster · ffuf · dirsearch
Exploitation: metasploit · searchsploit · msfvenom · revshells.com
Post-Exploitation: linpeas · winpeas · pspy · GTFOBins
Active Directory: impacket · kerbrute · enum4linux · CrackMapExec/NetExec · Bloodhound
Password Attacks: hydra · hashcat · john
All writeups are for educational purposes. Machines are legally accessible lab environments.