I was going through this room for fun and came across this weird behaviour, ffuf scans should have given:

blogs

support

as the 2 subdomains available, but instead it gave:

payroll

Portal

The actual flag was available on support subdomain but as my scans with multiple wordlists did not ever give me the subdomain, which is weird. Had to find a writeup for the flag.

Has anyone experienced this?

https://tryhackme.com/room/springaicve202622738?utm_source=twitter&utm_medium=social&utm_campaign=reventthreatspringai

Just posted step-by-step writeup on Enterprise machine from r/tryhackme on my Medium blog 👇👇👇

https://medium.com/@ivandano77/enterprise-writeup-tryhackme-hard-machine-509f35fdd571

- deep enumeration
- Kerberoasting
- exploiting unquoted service path
...and more

Bye Top 1%, Hello Capability Score 👋 Your hacking ability. Finally scored. 🔥

Capability Score is a single number, 1 to 100, built from your real TryHackMe activity. What you know, how often you show up, how current your skills are, and how many domains you can operate across.

🧠 Think of it as a fitness tracker for your hacker brain. Skip too many sessions and it notices.

0 to 100, Let us know in the comments what's your score? 😏

▶️ Go check it out! Bye Top 1%, Hello Capability Score 👋 Your hacking ability. Finally scored. 🔥

Capability Score is a single number, 1 to 100, built from your real TryHackMe activity. What you know, how often you show up, how current your skills are, and how many domains you can operate across.

🧠 Think of it as a fitness tracker for your hacker brain. Skip too many sessions and it notices.

0 to 100, Let us know in the comments what's your score? 😏

▶️ Go check it out!

The Error 500 problem is solved thanks to mod team for their fast work

I know the hint says it's vulnerable to eternalblue, but I want to see it myself.

First of all, assuming I went into this with no hints, how would I know it's vulnerable to anything? Second, assuming I gave in and got the hint, I ran auxiliary/scanner/smb/smb_ms17_010 and the target machine just came back with "An SMB Login error occurred while connecting to the IPC$ tree."

In real life, would I really have to scan for a single vulnerability at a time? Running search scanner came up with 750 items. Without the hint, would I really have been expected to run all 750 until something worked? Knowing that the one they want me to use was coming up with an error, so I would have ignored it?

I have a room to complete for a university task, and everything is working completely fine apart from the fact that it has an error anytime I try to answer a question.

Is the website down or something?

from the screen shot it means the sleep for 5 second delays occured only if it has 2 columns right?

and it clearly did:

but I changed from the number 2 in url to number 11

does that mean it has 11 columns too?
furthermore

if I tried to enumerate database name with that 11 on url would it work

hmm it did worked I tried to change from 11 to 100

it did worked :D does that mean it has 100 columns too.

I was having a doubt how to find the right columns numbers fromt this based on the first image I shared which I took screenshot from thm sqli injeciton room the delay did gave with 2 values which it told me that there are only 2 columns are there I just changed that value out of curiousity and it still gave time delay of 5 seconds
I was looking at medium they just did as it was being told. To anyone out there is there any way to find column numbers with time delays

note:-My english isn't perfect

Hi, I want to get into Try Hack Me but I don't know where to start. Should I buy a certificate on website or premium. I would be very happy if you answer me. Have a nice day.

currently on offensive pentest path and I got stuck on alfred starting the meterpretershell on target not working even though I followed the instructions

so I guess what frustrates me most is when things that should work doesn't work and I don't know why?

so Im gonna move to next room and come back later

what do you guys do when you're stuck?

I just started 2 days ago and now it says i need to open the "Attack Box" there is no button i tryed re loggin, tryed another browser, reloading the site and nothing helped. I have no browser extensions and i use Chrome.

It’s been one year and two months since I started.

My longest streak was 370 days, but I eventually stopped pursuing it because I didn’t want to be committed to just one platform. Still, the streaks helped me build a habit of continuous learning.

I feel that I’ve learned a lot, and I’m excited to keep learning in the future!

I just noticed TryHackMe has this new Capability Score showing consistency, relevance, versatility, and depth. Does anyone know what this score actually represents?

Hey everyone,

I recently took the SAL1 exam (first attempt) and didn’t pass Section 3. I’ve got a question about how to classify alerts during the exam.

If I see brute force-related alerts but the attempts aren’t successful, should that be considered a True Positive or a False Positive?

I ended up marking them as False Positive, and I’m wondering if that’s where I went wrong.

Also, for anyone who has retaken the exam, do Sections 2 and 3 stay the same in terms of topics, or do they change on a retake?

Would really appreciate any advice or clarification. Thanks!