My original winter-break project was a broad 30-day CTF plan. It started with OverTheWire Bandit, moved through short general-skills challenges, and was supposed to branch into web exploitation, cryptography, forensics, reverse engineering, binary exploitation, and a timed CTF.
That plan was useful because it made me practise every day. It also helped me build a journal structure that records more than a completion badge. By Day 18, however, the work I was actually doing had become much more focused than the schedule I had written.
I had completed Linux and Git exercises, network-protocol rooms, SQL injection, XSS, CSRF, IDOR, Nmap scanning, application mapping, content discovery, modern web-stack vulnerabilities, web-server attacks, and the beginning of Burp Suite. Most of those rooms already belonged to, or directly supported, TryHackMe’s Jr Penetration Tester learning path.
The journal and the plan were starting to tell two different stories. The sensible choice was to update the plan.
Why I chose a structured pentesting path
CTF challenges are still valuable. They teach persistence, tool fluency, creative problem-solving, and how to work with incomplete information. The weakness in my original schedule was not CTF practice itself; it was the amount of context switching.
Moving from web exploitation to classical cryptography, then to file forensics, reverse engineering, binary exploitation, and back to a full machine would give me broad exposure. It would not give me as much practice joining the stages of a penetration test together.
The Jr Penetration Tester path provides that connection. Its modules move through reconnaissance, Nmap, web application testing, Burp Suite, vulnerability research, password attacks, exploitation, privilege escalation, Active Directory, methodology, and reporting. TryHackMe also rebuilt the path for 2026, adding more depth in web security, Active Directory, end-to-end methodology, and practical challenges.
That sequence is closer to the skill set I want to develop and easier to explain in a portfolio. Instead of presenting isolated flags, I can show how enumeration produces evidence, how evidence guides testing, how an exploit is validated, and how the result should be communicated.
Preserving the first eighteen days
I did not restart the project or rewrite the completed entries to make them look as though this had always been the plan.
Days 1–7 remain the original CTF and Linux foundation. Days 8–18 show the gradual move into web and network pentesting. Those entries are useful evidence of how the project evolved, and changing them after the fact would make the journal less honest.
The revised plan starts on Day 19, immediately after my first Burp Suite sessions. From there, the remaining days continue through:
- Burp Suite’s manual-testing workflow
- SSRF and the Recruit web challenge
- Session management and broken authentication
- File inclusion and command injection
- API testing and the Support challenge
- Vulnerability research and scan triage
- Wordlists, Hydra, and offline password cracking
- Metasploit exploitation and post-exploitation
- Linux privilege escalation and a pentest-style report finding
I also kept the existing project URL and internal journal ID. That avoids breaking links from the original announcement post, tag pages, search results, or Decap CMS. The public title and description now explain the project’s current direction, while the route preserves its history.
Pairing every room with practice
The most important change is that a room is no longer the whole task for a day. Each future entry has a second checklist for practical work on the room’s authorised lab machine.
For example, completing a Burp room is paired with saving a clean baseline request, changing one input at a time in Repeater, and recording the response difference. A vulnerability-scanning day requires a triage table that separates confirmed findings from false positives. A Metasploit day requires the module, options, payload, session evidence, and cleanup steps to be documented.
This turns room completion into evidence that I can revisit. It also gives each daily page something useful to show beyond copied notes.
The journal prompt now asks me to capture:
- The room or challenge completed
- The practical artifact produced
- Commands, requests, and evidence
- Assumptions and dead ends
- Remediation or defensive observations
- One technique to repeat without guidance
All active testing remains limited to TryHackMe’s deployed lab targets or other systems where I have explicit permission.
Removing the deadline
The current learning path is much larger than the time left in the original thirty-day sprint. Compressing the whole path into that deadline would encourage rushing and would make the completion claim misleading.
Instead of treating Day 30 as a finish line, I removed the cap. Days 19–30 still contain the next logical rooms after my completed work, but Day 31 and later can continue directly into Active Directory, Windows privilege escalation, Python scripting, specialised domains, the full reporting module, and the remaining capstone challenges.
The site now discovers journal weeks from the entries that exist instead of assuming there will only be five. The content schema and Decap CMS also accept any positive day and week number, so continuing the journal does not require another code change.
That decision keeps the daily workload practical and leaves enough time to repeat techniques instead of only answering room questions. The journal ends when the learning goal is complete, not when the counter reaches an arbitrary number.
What success looks like now
I want more than a list of rooms. I want a repeatable workflow and evidence that I understand why each step exists.
The ongoing milestones are:
- Dated journal entries with completed work preserved as it happened
- A consistent process from reconnaissance to privilege escalation
- A practical artifact for every study day
- Independent attempts at Recruit, Support, Checkmate, and Jump
- At least one clear pentest-style finding with evidence, impact, reproduction steps, and remediation
- Continued entries through the remaining Jr Penetration Tester modules and capstones
Changing a plan halfway through is not the same as abandoning it. In this case, the first eighteen days gave me enough evidence to choose a more useful direction. The revised journal keeps that history, gives the ongoing work a clearer purpose, and leaves room to continue for as long as the path requires.