Room: Towel on the SunbedCategory: Web | Difficulty: Medium | Points: 90 Ponzi set his towel down for one 24-hour reward claim. He came back to find the sunbed had been “claimed” three times over while he wasn’t looking. This one is a race condition challenge dressed up as a crypto rewards app. The briefing
This challenge is part of TryHackMe’s Love at First Breach 2026 Valentine event. Challenge: Corp WebsiteCategory: Web Difficulty: Medium I started by visiting the target web app and intercepting traffic with Burp Suite Proxy. The application appears to be a wedding-planning business site, and it is built with Next.js. That technology detail ended up being important for narrowing down
This challenge is from the Love at First Breach Valentine event on TryHackMe. Challenge Title: ValenfindCategory: WebDifficulty: Medium The target web app is running on port “5000”. Before exploring the app, I ran an initial `nmap` scan to check for other exposed services. The service fingerprint on port `5000` shows: `Server: Werkzeug/3.0.1 Python/3.12.3` That strongly suggests a Flask
This challenge is from the Love at First Breach Valentine event on TryHackMe. Challenge title: TryHeartMeCategory: Web Difficulty: Easy The objective of this challenge is to purchase the hidden Valenflag item from the web shop. I started by opening the challenge URL (port 5000) and monitoring traffic with Burp Suite to understand request and response behavior. The target application is a Valentine-themed
This challenge is part of the Love at First Breach Valentine event on TryHackMe. Challenge title: Hidden Deep Into my HeartCategory: WebDifficulty: Easy I started with a quick service scan using nmap. nmap -sV [MACHINE_IP] The main target was on the port 5000. The fingerprint (Server: Werkzeug/3.1.5 Python/3.10.12) indicates a Python web app, likely Flask. Next, I browsed the app
This post is a write-up for the “Security Footage” challenge on TryHackMe. The challenge description reads: “Someone broke into our office last night, but they destroyed the hard drives with the security footage. Can you recover the footage?” We’re provided with a .pcap file (packet capture) that presumably contains the remaining trace of the lost footage. Analyzing
In this write-up, I’ll guide you through solving the Light challenge from TryHackMe. The challenge involves exploiting a database application to retrieve sensitive information. Let’s dive into the steps! Challenge Description The task provides the following instructions: I am working on a database application called Light! Would you like to try it out?If so, the application is
Challenge Description The Sticker Shop “Your local sticker shop has finally developed its own webpage. They do not have much experience with web development, so they decided to develop and host everything on the same computer that they use for browsing the internet and looking at customer feedback. Smart move! Can you read the flag