TryHackMe Checkmate Walkthrough: Password Cracking Using Hydra, CeWL, CUPP & Crunch

Hello Everyone,

Weak passwords remain one of the easiest ways attackers gain initial access. The Checkmate room on TryHackMe demonstrates how information gathered during reconnaissance can be transformed into targeted password attacks using tools like Hydra, CeWL, CUPP and Crunch.

I came across this room when I was completing the Junior Penetration Tester certificate. This room focuses on exploiting weak password practices and creating custom password lists based on gathered information.

Checkmate room

When booting up the machines, there are 5 levels we have to complete to finish the room.

The First level is that Marco deployed a firewall at <IP>:5001 with default credentials.

Visiting <IP>:5001, we see the login user page. And in the username field, there was a placeholder “admin”. Considering that I kept the username as admin and started Hydra for brute-forcing.

hydra -l admin -P /usr/share/wordlists/rockyou.txt <IP> http-post-form “/login:username=^USER^&password=^PASS^:F=invalid” -V

• -l: specifies a single username
• -P: Specifies wordlists
• http-post-form: Method for input
• -V: To see output
• /login: Form path
• “:username=^USER^&password=^PASS^”: specifying path for inserting username and password
• “F=invalid”: Determines failed attempts
• -s: Specifies custom port

Voila, we got the first flag

Moving on to the Second level, Marco built an internal employee login portal accessible from <IP>:5002. The hint is that we have to use common company keywords as passwords.

Since the hint suggested company-related passwords, Cewl was a good choice because it automatically extracts keywords from a website that employees are likely to reuse in passwords.

• -d: Defines depth
• -m: Defines to include up to 6 characters.
• — lowercase: Converts to lowercase
• -w: Specifies the path to store extracted words.

When getting the wordlist from Cewl, I used hydra to brute-force the password.

two levels completed, three more to go

The third level was to navigate to <ip>:5003 and derive Marco’s password from personal info.

I used CUPP(Common User Password Profiler) for creating specific wordlists around a particular person using their personal info.

CUPP generated a custom wordlist containing over 7,400 password candidates based on Marco’s personal information.

After getting the list from CUPP, use Hydra.

2 more to go.

Moving to the fourth task, the hint given is that we have to identify and decrypt Marco’s uploaded profile picture.

I got the filename when inspecting the webpage.

Simply add the file name to the SHA256 decrypter to complete the fourth level.

Level 5 — Predictable Password Patterns

Analyzing Marco’s social media, I came across the last post made by Marco.

Based on this, I used Crunch to generate custom wordlists including all the words Marco mentioned in his last post.

After generating the custom wordlists, I used Hydra again to brute-force the SSH service.

My Verdict:

• Checkmate demonstrates that successful password attacks rarely rely on massive brute-force attempts. Instead, attackers combine reconnaissance, public information, custom wordlists, and targeted guessing to dramatically reduce the search space. Understanding this methodology helps defenders build stronger authentication systems and helps aspiring penetration testers develop a structured approach to password assessments.

See you in the next one. Till then, happy hacking.😉

More TryHackMe Walkthroughs. Looking for more hands-on cybersecurity labs?

Browse my complete TryHackMe Walkthrough Collection:https://medium.com/@parshva2033/complete-tryhackme-walkthrough-collection-updated-2026-6f38e5c612c0

About the Author Hi, I’m TibeRius_12, a master’s student in Cybersecurity and an aspiring penetration tester. I document my journey through TryHackMe labs, Active Directory, web security, and practical VAPT methodologies. If you enjoy hands-on cybersecurity content, feel free to follow me for future write-ups.