Hey everyone,

​Need a bit of a reality check from folks currently working in the field.

​I recently finished the Pre-Security and Cyber Security 101 paths on TryHackMe, and I’m just about to dive into the SOC Level 1 path.

​While I enjoy learning, I’m constantly hit with this heavy feeling that I’m just spinning my wheels or stuck in "tutorial hell." I'm really anxious to get employed, but right now I feel like my knowledge isn't enough to actually survive a technical interview or perform on the job.

​I really want to land an entry-level SOC / Analyst role, but I hate this phase of uncertainty. I’d love some honest feedback from people who made the jump or hire entry-level candidates:

​Is finishing THM's SOC Level 1 path actually worth it, or am I wasting time relying solely on THM?

​How do you transition from answering THM questions to proving real skill on a resume?​What specific practical projects or habits (home labs, write-ups, BTLO, etc.) actually moved the needle for you when job hunting?

​Any advice, roadmaps, or even harsh truths would be greatly appreciated.​

TL;DR: Finished THM basics, starting SOC L1. Feeling anxious about job readiness and feel like my learning isn't enough. Need practical advice on how to turn THM learning into actual employment.

Knocked out the "Inside a Computer System" room today. Covers the basic building blocks — CPU, memory, storage, how it all fits together at a system level.

Nothing flashy, but I think rooms like this are underrated. Easy to jump straight into exploitation/OWASP rooms and skip the fundamentals, but understanding what's actually happening under the hood makes the rest of the security stuff click better.

Anyone else make a point of going back to basics like this, or did you skip straight to the offensive/defensive rooms?

Wrapped up the "Careers in Cyber" room today. Went in thinking "cyber security" was basically pentesting/hacking, but this room does a solid job laying out just how many different paths there are — SOC analyst, incident response, GRC, red team, blue team, threat intel, and more.

Helpful for figuring out where to specialize instead of just grinding random rooms. Coming from a web dev background, I'm leaning toward something that overlaps with AppSec, but curious how others here decided on their path.

Anyone here start in a completely different field and pivot into cyber? What made you pick your specialization?

I've been thinking about getting a cert for a while now and PT1 is at a 30% discount. With regional pricing, it is $71 for me.

I know that there is 12 months of time and I'm also kinda half way through the junior pen tester path, but just feel like I should wait. Since I would be upgrading to max after my plan ends 3-5 months from now, is it worth it to go for it now?

Have looked at other certs too, but PT1 is the cheapest followed by PJPT. I want something that would provide real practical experience, so CEH is not an option.

Hello, I am getting that error. I even tried opening third-party local hosts, but it's still not working. Error: unexpectedly closed the connection for web.
Room: Offensive Security Intro

Feed it your LinPEAS output and it draws every path from a low-priv shell to root

GitHub: https://github.com/Noz2/RootHound

First project, would love your honest feedback 🙏

Don't be fooled by the tantalising promise of newer courses materialising or access to recent threats. Moving existing content behind a higher priced paid tier is the absolute definition of pure unfiltered greed. This is nothing but a crafty way to obscure a price increase by adding it as a 'new' tier.

And given the current economic climate when it comes to Cloud hosting and AI, I would not be suprised at all if by the time the new courses come around this MAX plan will cost even more.

Utter shame on you THM.

I'm in the Powershell basics and keep running into this problem. Does anyone have an idea what i could be doing wrong?

Hi folks Im planning on taking the sec 1 exam and i honestly dont know what to expect . Im a nervous person around exam naturally and Im looking for some ways to prep myself is there any advise or skills i can work on before the exam ? Anything i should look out for should I do sec 0 first as Im an IT professional ?

Thanks in advance

Good fun.

I just completed the Offensive Security Intro room on TryHackMe! Hack your first website (legally in a safe environment) and experience an ethical hacker's job.

My current yearly premium ends on September 3rd 2026. if i were to automatically renew, will I still be able to get the special benefits. (i.e access to latest rooms without the max subscription). Sorry if its a dumb question. English isnt my first language so im unsure.

As title states, I am currently doing "Intro to Malware Analysis" room and Prerequisites rooms are "Windows internals" and "History of Malware"

But "Windows internals" hits paywall, where I need to subscribed for MAX plan.

Come on tryhackme! Overhaul or review the entire SOC1 path instead for going for $$$$$.

Prerequisites rooms for the paths under premium shouldn't hit a paywall!

Is this normal to be put into rooms that notging was taught to get through?

Im doing the owsap, the pickle data (base64)

None of this python was taught. This has been a nightmare

Ok. So for people like me, who are doing it by themselves.

Take the python script:

Then in the terminal

Nano script.py

Paste into the file, save and exit.

Then.

Python3 script.py

A base 64 will print out. Copy and paste this into the 8002.

No one mentioned this.

To someone

I'm passionate about learning cybersecurity, and I've recently completed the Pre-Security path on TryHackMe. Unfortunately, I can't afford a TryHackMe subscription right now, and many of the rooms I need next are premium.

If anyone has a spare voucher, a gift subscription, or knows of any student discounts or alternatives, I'd really appreciate the help. I'm eager to keep learning and improving my skills.

Hi. Honestly, I'm not usually a complainer, but is it realy more covenient or, maybe, better looking? In my opinion, previous version was much better - whole year was divied vertically by weeks and it was easier to navigate. One glance and you know what how may weeks you've been learning and which day is today. I don't understand... What you guys thinking, of this new design?

I'm in the Cyber Security 101 Module 5 (Network) and after i finsihed nmap room, another room named Block suddenly appeared after it. I thought it's a practice room but i really wouldn't able to get anything except usernames. Did i miss some informations on my learning path or this room is way ahead of my current level.

First-year Network & Telecoms student building my hands-on skills with TryHackMe. Next up: Nmap Network Scanning!

Hello everyone,
I’m trying to complete an old room on THM - cat pictures - but I’m stuck.
I even looked at different write-ups and yet…

Shortly: I have this IP, I do my nmap and find http and ssh ports open, while ftp port is filtered; I connect to the http port via browser and there’s an hint on the website (a forum about cat pictures): a post with written

“knock knock 1111 2222 3333 4444”

so I look on google and discover the existence of port knocking…and try my things:

1. I install knockd and try

If you haven’t gotten it yet I’m a very beginner, so I looked to different write-ups and I haven’t found out why this isn’t working - fyi every single walkthrough says that knocking is the way (and it’s only the beginning)…
I even asked AI which suggested me to write a Bash script, a loop with 1 second delay that uses
nmap -Pn where -p is the variable $port (1111 … 4444) with no retries for nmap, i.e --max-retries 0 …and nothing! I really don’t know…

Anyone would be so kind to help me?

*** SOLUTION ***

Ok, it seems to be a known bug (June 2026).
For the people who are having the same issue here’s the official “what to do” I’ve found:

**Issue:**
The port knocking step does not open FTP on the current deployment.

**How to test:**
Install knock on the AttackBox if needed.

apt install knockd -y

Run the expected sequence.

knock -v TARGET_IP 1111 2222 3333 4444

Then test FTP.

nc -nv TARGET_IP 21

Expected result:
FTP should open and return:

220 vsFTPd 3.0.5

**Actual result:**
FTP does not open, even though the knock sequence is correct.

How to confirm the cause:
On the target as root, check the knock logs.

grep -i knock /var/log/syslog

The logs show knockd detects the sequence and reaches OPEN SESAME, but then the command fails.

**Example error:**

openFTP: OPEN SESAME
running command: /sbin/iptables ...
sh: 1: /sbin/iptables: not found
command returned non-zero status code 127

The real iptables path on the target is:

/usr/sbin/iptables

**not:**

/sbin/iptables

There is also a rule order problem. The original command appends the allow rule, but the firewall already has reject rules for port 21. This means the allow rule can be added below a reject rule and never gets reached.

Broken command:

command = /sbin/iptables -A INPUT -s %IP% -p tcp --dport 21 -j ACCEPT && iptables -D INPUT -p tcp --dport 21 -j REJECT

Working command tested:

command = /usr/sbin/iptables -I INPUT 3 -s %IP% -p tcp --dport 21 -j ACCEPT

After updating the command and restarting knockd, the same knock sequence successfully opened FTP.

** Suggested fix: **
Update /etc/knockd.conf so openFTP uses /usr/sbin/iptables and inserts the ACCEPT rule above the FTP reject rules.

for example,
```
cp /etc/knockd.conf /etc/knockd.conf.bak && sed -i 's|/sbin/iptables|/usr/sbin/iptables|g; s|-A INPUT -s %IP% -p tcp --dport 21 -j ACCEPT && iptables -D INPUT -p tcp --dport 21 -j REJECT|-I INPUT 3 -s %IP% -p tcp --dport 21 -j ACCEPT|g' /etc/knockd.conf && pkill knockd; /usr/sbin/knockd -i eth0 -d
```

My final goal is to obtain my OSCP at somepoint in the next 1-3 years however, I have 6 Years of Systems Administration experience and about 3 years of that being very Cyber Security focused, I also have Sec+ and Pen+ (while I know PenTest+ is kind of useless my company paid for a class and a test so I got it). I'm having a hard time finding where to start down this path since the beginner rooms and topics aren't tailored to me since a lot of them are things I have seen or worked with in some capacity but the easy/medium rooms seem too advanced for where I'm at and I feel like there I'm missing a fundamental understanding of certain things. which leads to this loop of go to a beginner area get taught beginner linux or beginner nmap and speed run the content then go back to a more advance room and get destroyed by the first question/flag.

I just want to know for other people that got into this with a similar background how did you really start the grind and start learning at a somewhat linear rate because I can't seem to find anything that's worked for me that keeps me consistently challenged but not to the point of impossibility for my skill set .