Root Me

Root Me is one of the oldest and most complete ethical hacking challenge platforms around. It started in France as a non-profit project and now hosts hundreds of free challenges covering web, systems, networking, cryptanalysis, forensics, cracking, steganography and programming. If you want a place to practise a bit of everything, at your own pace and without paying, Root Me is a safe bet.

What is Root Me?

Root Me is a challenge website organised by category. Each challenge has a difficulty, a score and a flag or password you validate on the site. Besides individual challenges it offers CTF all the day: virtual environments with vulnerable machines you can launch and attack like a real pentest. The interface is available in several languages, including English and Spanish, although some challenge descriptions remain in French.

There is also a professional offering (Root-Me Pro) aimed at companies and training, but the community platform is free to use.

What Root Me is used for

• Practising fundamentals by category: focus on Web - Server if you are into web pentesting, or App - System if you want binary exploitation.
• Preparing for CTFs and certifications: the range of techniques is huge and many show up in practical exams.
• Tracking your progress: points and rankings keep you motivated.
• Learning with documentation: each category links reference documents (papers, articles) related to its challenges.

How to get started with Root Me

1. Sign up for free on the official website and pick your interface language.
2. Sort each category's challenges by number of validations: the most solved ones are usually the easiest.
3. Start with Web - Client and Web - Server, which only need a browser and a proxy.
4. For system challenges, connect over SSH to the servers each description gives you.

Tools worth having at hand: a browser with developer tools, a proxy such as Burp Suite or OWASP ZAP, Python 3 and an SSH client.

Practical examples

App - Script and App - System challenges are done over SSH. The general pattern is this (host, port and user are given by each challenge):

ssh -p 2222 challenge-user@given-server.root-me.org
ls -la
cat ch1.c

Once inside, always read the source code and the permissions. Many challenges revolve around SUID binaries, environment variables or relative paths. Useful inspection commands:

id
find / -perm -4000 -type f 2>/dev/null
file ./ch1
strings ./ch1 | less

In web challenges the usual flow is to intercept the request, work out which parameters you control and tamper with them:

curl -i "http://challenge01.root-me.org/web-serveur/chX/"
curl -i -H "User-Agent: test" -b "cookie=value" "http://challenge01.root-me.org/web-serveur/chX/"

You will not find passwords or solutions here: Root Me forbids publishing them. General hint: read the description twice, check the documentation linked to the challenge and try the simplest thing first.

Suggested learning path

1. Web - Client: JavaScript, forms and browser-side logic.
2. Web - Server: HTTP headers, injections, file uploads, authentication.
3. Programming: scripts that talk to services under time limits.
4. App - Script: basic Linux privilege escalation over SSH.
5. Cryptanalysis and Steganography: classical ciphers and hidden data.
6. Network and Forensics: analysing traffic captures and dumps.
7. Cracking and App - System: reversing and binary exploitation once you know some C and assembly.
8. CTF all the day: full machines to bring everything together.

Pro tips

• Take notes on every challenge: technique, tool and the mistake you made. That becomes your cheat sheet.
• Do not get stuck for hours on one; switch category and come back later.
• Read the documents each challenge links. They often contain the exact technique you need.
• After validating a challenge, check other users' solutions available on the platform to learn different approaches.

Pros and cons

Pros	Cons
Free with hundreds of challenges	Some descriptions are only in French
A huge range of categories	Less guided interface than other platforms
Reference documentation per challenge	Few step-by-step explanations for absolute beginners

Root Me alternatives

• TryHackMe: more guided, ideal if you are starting from scratch.
• Hack The Box: machines and challenges with a more competitive feel.
• OverTheWire: SSH wargames that are perfect for learning Linux.
• CryptoHack: if cryptography is your thing.

Frequently asked questions

Is Root Me free?

Yes. Challenges on the Root Me community platform are free with registration. The Pro offering is aimed at companies and training centres.

Is Root Me legal?

Yes. All challenges run on the platform's own infrastructure, which is designed to be attacked. What is not legal is using those techniques against third-party systems without authorisation.

Is Root Me available in English?

The interface has an English version, but some challenge descriptions and documentation are still in French. A browser translator handles nearly everything.

Is Root Me good for beginners?

Yes, if you start with the most validated challenges in each category. Basic Linux and HTTP knowledge still helps a lot.

If you need to strengthen those Linux and networking basics first, practise at the Hackers en Acción Academy.