I finished pre-security and halfway through cybersecurity101, should i countniue down the path on thm fining my current course and next jr pen tester course. Or transtions to pwn college and take their core fundmentals courses like linux, computing 101 to understand computer architecture etc as prerequisite to learn c then go back on pwn college courses.

I am really passionate about vunreability research and low level concepts and like to learn about hardware and stuff, and i used thm pre and cybersecurity to build foundation to go to pwn college and take first steps to learning low level stuff.

Is that a good roadmap what are your thoughts?

🚩 Recruiting: Cybersecurity Team (TryHackMe) 🚩

Team: ShadowSentinels Owner: swatantra

We're building a team to grind TryHackMe rooms, CTFs, and eventually compete in live cyber challenges. Looking for a few committed people to join the crew.

Join the Team

Use this invite link to join ShadowSentinels on TryHackMe (role will be assigned after joining): 👉 https://tryhackme.com/manage-account/teams?joinTeam=aa7fde2574

What We're Doing

• Solving TryHackMe rooms together (Web, Networking, Linux, Privilege Escalation, etc.)
• Prepping for CTF-style competitions
• Sharing writeups and learning from each other's approach
• Building toward more advanced paths (Red Teaming, OSCP-style content)

Who We're Looking For

Must-haves (Basic Qualifications):

• Comfortable with basic Linux command line (navigation, file permissions, basic scripting)
• Understanding of core networking concepts (TCP/IP, DNS, HTTP/HTTPS, ports & protocols)
• Basic knowledge of how web applications work (client-server model, cookies/sessions)
• Willingness to learn — you don't need to be an expert, just consistent

Good to have (not mandatory):

• Some TryHackMe or HackTheBox rooms already completed
• Familiarity with tools like Burp Suite, Nmap, Wireshark
• Basic scripting (Python/Bash)
• Any CTF experience (even solo)

Mindset we want:

• Curious — you like figuring out why something works, not just following a walkthrough
• Consistent — a few hours a week, every week, beats one binge session
• Team player — shares stuck points instead of hiding them, helps others when they're ahead

How to Join

1. Click the invite link above to join ShadowSentinels
2. Drop a message with:
   • Your TryHackMe profile link (if you have one)
   • A rough idea of what you've explored so far (even "just started" is fine)
   • How much time you can commit weekly
3. Owner (swatantra) will assign your role once you're in

No prior "hacker" background required — just genuine interest and consistency. Let's build something solid together. 🔐

DM / comment to get added to the group.

📢 A note for everyone in ShadowSentinels

Everyone's welcome to go at their own pace here — there's no fixed schedule or pressure to perform. Get involved as much or as little as fits your life right now. The only real rule: everything we do stays strictly legal and ethical — practice on TryHackMe rooms and CTFs only, never against real systems or people without authorization. No harming others, no crossing lines.

Join us on Discord so we can collaborate, share writeups, and grind CTFs together as a team:
👉 https://discord.gg/SWZ7UtRNU

Learn, help each other out, have fun — that's the whole point. 🚩

Just finished this room and wanted to share a couple of takeaways.

The room walks through A01 (Broken Access Control), A07 (Identification & Authentication Failures), and A09 (Security Logging & Monitoring Failures), tying them back to the IAAA model — Identification, Authentication, Authorization, Accountability.

The hands-on part had me exploit an IDOR by just changing an id parameter in a URL to view another user's bank account data — found one with a $1M+ balance just by iterating through IDs 1-10. Simple exploit, but a solid reminder of how "broken access control" isn't some abstract concept — it's often just a missing authorization check on the backend.

Solid room for anyone starting out in web security. Currently working through the rest of the OWASP Top 10 series — anyone have recommendations for what to tackle next after this one?

What comes after I finish the PreSecurity path and get my certification?

I’ll admit that I’ve used the app quizzes to climb the rankings by completing a lot of quizzes on my downtime e.g on bus

But 162,002 points in just 22 days? It is difficult to believe someone could achieve that by manually interacting with the TryHackMe mobile app and answering every quiz normally. You would go insane

https://tryhackme.com/p/RCDM.exe

I’m less certain about this account with 62,185 points:

https://tryhackme.com/p/pavloni

Even that would appear to require roughly three to four hours every day spent continuously submitting app quizzes, which is feasible but ;/

App really needs to be hard limited to say 200 points a day,

What do others think?

UPDATE: It was unintended! Support was fast with response and changed the room to premium.

My old rant:
I have bought Premium subscription to complete Cyber Security 101 and get Certificate of Completion and now Tryhackme asks for addition 30$ to buy Max Plan just for 1 room. This is unfair especially because it states that Premium has: Full access to Beginner & Intermediate Learning Paths. This site became a scam, and this is greed.

Hey everyone, I’ve been working my way through the TryHackMe Pre-Security Path and documenting everything as I go. I just updated the repository and wanted to share the link with the community in case anyone else finds it helpful for their foundational learning.

Repo Link : Pre Security Notes Link

Since it's still a work in progress, I would love to get your input:

• Please feel free to share your opinions on the layout or content.
• If you spot any technical inaccuracies or areas that need better explanations, let me know!
• Suggestions for resources to add are highly welcome.

Hope this helps anyone else starting out on their cyber security journey. Let me know what you think!

If i choose one linux option the other one automatically choosen. And not left any option for last.

CVE-2026-63030 dropped Friday. Our team had a room ready by Monday. You wrapped a pentest for a client. Their app is clean, but their WordPress blog wasn't in scope.

CVE-2026-63030 changes that conversation. An unauthenticated attacker can exploit the REST API with a SQL injection, forge an admin account, and achieve remote code execution.

This vulnerability was discovered using a GPT prompt and $25 by a security engineer with 3 years of experience. Not a nation-state, not a specialist research team. Understand the full exploit chain and how to mitigate it in our new threat room, WP2Shell.

🚀Available now on MAX:
https://tryhackme.com/room/wordpresscve202663030?utm_source=reddit&utm_medium=social&utm_campaign=recentthreatwordpress

Hi, I'm a new subscriber to this platform. And currently I'm working full-time during the day and am a postgraduate student at night. So I can only study THM on the weekends.

We're inviting one lucky user who has been impacted by TryHackMe to our company retreat in Malta on Sept 21-25!☀️
Meet the team, enjoy activities, and relax at a 5-star resort. All expenses covered!🎉

Fill out the survey by the 24th of July at 12PM BST to be considered🔥

https://forms.gle/urg8YJmhvKknqdou6

Im about 76% done with PreSecurity when I noticed an unfinished room from what seems to be months ago. I still remember exploring this room, so I dont seem to know how it is unfinished. Its only a 15 minute room so it isnt very much of a big deal but I was just wondering what prompted it. The room is Defensive Security Intro, which im very sure I completed.

ive recently gotten into tryhackme but after doing 3 modules i was hit by a paywall and im confused on where to go. what room order should i be doing to become a security analyst.

Hello everyone, after completing everything I wanted to on THM and moving on, I decided to give away my vouchers. To be eligible, all you have to do is the following:

• Check out this project:
  • https://dragkob.com/security-certification-roadmap/
  • https://github.com/Dragkob/Security-Certification-Roadmap
• Drop your feedback in the comments section here + your GitHub @.

That's it! Please note that the Desktop (PC) version of the website is miles better than the Phone one. So, feedback on any/both would be appreciated. Just make sure to mention which one.

If you star the project on GitHub, I'll obviously be more inclined to support someone who's supporting me, it's the least I can do in return.

This project has been created by old THM members, and almost all of us have moved on, so this is my way of giving back to the THM community a final time.

Greetings, I won the Red Raffle that got me a 50% off voucher code for the PT1. However, when trying to check out the certification, it won't let me use my voucher since the code CERTIFY is being automatically redeemed. I am a current premium user.

I already submitted a ticket to TryHackMe but I have yet to receive a response from them.

Does anyone have a solution for this? Thank you!

Hello predecessor. I would like you to recommend training for apprenticeship. I am very beginner

I’m really annoyed with THM, especially after the whole MAX tier thing… but in particular, I’ve noticed the ai bot helper (echo? I think it’s called) has disappeared from rooms.

Even if it isn’t in every room, I looked back at rooms it was in, and it’s nowhere.

I didn’t even use or rely on it, but the fact that THM uses it as one of its bullet points for their paid tiers, and then it disappears is ridiculous…

Has anyone else noticed that is gone? If not, what rooms can you actively see it in? What subscription are you on?

THM’s support is another thing - I can’t get in touch with them through the platform, or their support email… I get no response.

Unreal.

Hi there, I used try hack me almost regularly from my pc with my gmail and later edited my mailaddress(@) of the same account ..

didn't face any issues then.. but later when i downloaded thm pulse on my mobile ..i typed in my edited address after the continue screen and typed my mail password but it says 'Uh oh password or email incorrect' ..i tried multiple times but it just locks me out after failed times :<

Can anyone help with this coz idk if you need a separate acc for mobile and pc ?

Ps: ik i can just use the pc but it would be better to have it on my phone also cause the pc isn't accessible to me all time

Hi guys, I just joined because I’m having a lab issue and I haven’t gotten an answer from THM support so I was hoping someone here could help.

I’m in the OWAS Juice Shop room. I made it all the way down to task 7 and I ran into an issue.

Question 2 is “Perform a persistent XSS”

I have tried this one multiple times, I’ve tried with different browsers, and different machine instances, each time I get the same result.

I go through the process:

Login as admin
Turn on burp suite/set monitor to on
Log out of the admin account
Capture the packet that saves the IP
Insert the script line into the packet
Forward the packet to the server

I logo back into the server, I go to the last login IP page and the box that says “XSS” pops up.

It looks like everything works, but I don’t get a completion code. No matter how many times I have done it. I asked the AI assistant and eventually it said it looks like I did everything right and I needed to contact support

Can anyone help with this while I wait for support to get back to me?