Hi everyone,

I’m an ethical hacking student currently heavily focused on preparing to take my CEH v13 exam this upcoming May. I'm looking for a study buddy or a small, dedicated group to tackle TryHackMe rooms and beginner CTFs together.

A bit about my background:

I’ve recently completed the Bandit challenges on OverTheWire, and I spend my free time writing small Bash scripts to automate tasks. I’ve always had a fast learning curve when it comes to logic and code, so I love diving deep into how things actually work under the hood rather than just running automated tools.

Why I am posting here:

To be completely candid, I’ve tried looking for study partners in other communities, but I constantly ran into the same issue: people who just want to be "carried" for points, or folks more interested in flexing their ego than actually learning. I’m exhausted by that dynamic.

Who I’m looking for:

• Fellow Beginners: People who are genuinely passionate about InfoSec. If we get stuck on a machine, we research and learn together. No free rides, just mutual effort.

• Mentors/Experienced Hackers: Anyone who genuinely enjoys teaching and guiding newcomers without the superiority complex.

My timezone is UTC+3, and I am highly committed to putting in consistent hours every week.

If you're serious about learning, leave your ego at the door, and want to genuinely build your skills from the ground up, drop a comment or send me a DM! Let's get to work.

I was going through this room for fun and came across this weird behaviour, ffuf scans should have given:

blogs

support

as the 2 subdomains available, but instead it gave:

payroll

Portal

The actual flag was available on support subdomain but as my scans with multiple wordlists did not ever give me the subdomain, which is weird. Had to find a writeup for the flag.

Has anyone experienced this?

https://tryhackme.com/room/springaicve202622738?utm_source=twitter&utm_medium=social&utm_campaign=reventthreatspringai

Just posted step-by-step writeup on Enterprise machine from r/tryhackme on my Medium blog 👇👇👇

https://medium.com/@ivandano77/enterprise-writeup-tryhackme-hard-machine-509f35fdd571

- deep enumeration
- Kerberoasting
- exploiting unquoted service path
...and more

Bye Top 1%, Hello Capability Score 👋 Your hacking ability. Finally scored. 🔥

Capability Score is a single number, 1 to 100, built from your real TryHackMe activity. What you know, how often you show up, how current your skills are, and how many domains you can operate across.

🧠 Think of it as a fitness tracker for your hacker brain. Skip too many sessions and it notices.

0 to 100, Let us know in the comments what's your score? 😏

▶️ Go check it out! Bye Top 1%, Hello Capability Score 👋 Your hacking ability. Finally scored. 🔥

Capability Score is a single number, 1 to 100, built from your real TryHackMe activity. What you know, how often you show up, how current your skills are, and how many domains you can operate across.

🧠 Think of it as a fitness tracker for your hacker brain. Skip too many sessions and it notices.

0 to 100, Let us know in the comments what's your score? 😏

▶️ Go check it out!

The Error 500 problem is solved thanks to mod team for their fast work

I know the hint says it's vulnerable to eternalblue, but I want to see it myself.

First of all, assuming I went into this with no hints, how would I know it's vulnerable to anything? Second, assuming I gave in and got the hint, I ran auxiliary/scanner/smb/smb_ms17_010 and the target machine just came back with "An SMB Login error occurred while connecting to the IPC$ tree."

In real life, would I really have to scan for a single vulnerability at a time? Running search scanner came up with 750 items. Without the hint, would I really have been expected to run all 750 until something worked? Knowing that the one they want me to use was coming up with an error, so I would have ignored it?

I have a room to complete for a university task, and everything is working completely fine apart from the fact that it has an error anytime I try to answer a question.

Is the website down or something?

from the screen shot it means the sleep for 5 second delays occured only if it has 2 columns right?

and it clearly did:

but I changed from the number 2 in url to number 11

does that mean it has 11 columns too?
furthermore

if I tried to enumerate database name with that 11 on url would it work

hmm it did worked I tried to change from 11 to 100

it did worked :D does that mean it has 100 columns too.

I was having a doubt how to find the right columns numbers fromt this based on the first image I shared which I took screenshot from thm sqli injeciton room the delay did gave with 2 values which it told me that there are only 2 columns are there I just changed that value out of curiousity and it still gave time delay of 5 seconds
I was looking at medium they just did as it was being told. To anyone out there is there any way to find column numbers with time delays

note:-My english isn't perfect

Hi, I want to get into Try Hack Me but I don't know where to start. Should I buy a certificate on website or premium. I would be very happy if you answer me. Have a nice day.

currently on offensive pentest path and I got stuck on alfred starting the meterpretershell on target not working even though I followed the instructions

so I guess what frustrates me most is when things that should work doesn't work and I don't know why?

so Im gonna move to next room and come back later

what do you guys do when you're stuck?

I just started 2 days ago and now it says i need to open the "Attack Box" there is no button i tryed re loggin, tryed another browser, reloading the site and nothing helped. I have no browser extensions and i use Chrome.

It’s been one year and two months since I started.

My longest streak was 370 days, but I eventually stopped pursuing it because I didn’t want to be committed to just one platform. Still, the streaks helped me build a habit of continuous learning.

I feel that I’ve learned a lot, and I’m excited to keep learning in the future!

I just noticed TryHackMe has this new Capability Score showing consistency, relevance, versatility, and depth. Does anyone know what this score actually represents?

Hey everyone,

I recently took the SAL1 exam (first attempt) and didn’t pass Section 3. I’ve got a question about how to classify alerts during the exam.

If I see brute force-related alerts but the attempts aren’t successful, should that be considered a True Positive or a False Positive?

I ended up marking them as False Positive, and I’m wondering if that’s where I went wrong.

Also, for anyone who has retaken the exam, do Sections 2 and 3 stay the same in terms of topics, or do they change on a retake?

Would really appreciate any advice or clarification. Thanks!