I’ll admit that I’ve used the app quizzes to climb the rankings by completing a lot of quizzes on my downtime e.g on bus

But 162,002 points in just 22 days? It is difficult to believe someone could achieve that by manually interacting with the TryHackMe mobile app and answering every quiz normally. You would go insane

https://tryhackme.com/p/RCDM.exe

I’m less certain about this account with 62,185 points:

https://tryhackme.com/p/pavloni

Even that would appear to require roughly three to four hours every day spent continuously submitting app quizzes, which is feasible but ;/

App really needs to be hard limited to say 200 points a day,

What do others think?

Hello everyone,
I’m trying to complete an old room on THM - cat pictures - but I’m stuck.
I even looked at different write-ups and yet…

Shortly: I have this IP, I do my nmap and find http and ssh ports open, while ftp port is filtered; I connect to the http port via browser and there’s an hint on the website (a forum about cat pictures): a post with written

“knock knock 1111 2222 3333 4444”

so I look on google and discover the existence of port knocking…and try my things:

1. I install knockd and try

If you haven’t gotten it yet I’m a very beginner, so I looked to different write-ups and I haven’t found out why this isn’t working - fyi every single walkthrough says that knocking is the way (and it’s only the beginning)…
I even asked AI which suggested me to write a Bash script, a loop with 1 second delay that uses
nmap -Pn where -p is the variable $port (1111 … 4444) with no retries for nmap, i.e --max-retries 0 …and nothing! I really don’t know…

Anyone would be so kind to help me?

*** SOLUTION ***

Ok, it seems to be a known bug (June 2026).
For the people who are having the same issue here’s the official “what to do” I’ve found:

**Issue:**
The port knocking step does not open FTP on the current deployment.

**How to test:**
Install knock on the AttackBox if needed.

apt install knockd -y

Run the expected sequence.

knock -v TARGET_IP 1111 2222 3333 4444

Then test FTP.

nc -nv TARGET_IP 21

Expected result:
FTP should open and return:

220 vsFTPd 3.0.5

**Actual result:**
FTP does not open, even though the knock sequence is correct.

How to confirm the cause:
On the target as root, check the knock logs.

grep -i knock /var/log/syslog

The logs show knockd detects the sequence and reaches OPEN SESAME, but then the command fails.

**Example error:**

openFTP: OPEN SESAME
running command: /sbin/iptables ...
sh: 1: /sbin/iptables: not found
command returned non-zero status code 127

The real iptables path on the target is:

/usr/sbin/iptables

**not:**

/sbin/iptables

There is also a rule order problem. The original command appends the allow rule, but the firewall already has reject rules for port 21. This means the allow rule can be added below a reject rule and never gets reached.

Broken command:

command = /sbin/iptables -A INPUT -s %IP% -p tcp --dport 21 -j ACCEPT && iptables -D INPUT -p tcp --dport 21 -j REJECT

Working command tested:

command = /usr/sbin/iptables -I INPUT 3 -s %IP% -p tcp --dport 21 -j ACCEPT

After updating the command and restarting knockd, the same knock sequence successfully opened FTP.

** Suggested fix: **
Update /etc/knockd.conf so openFTP uses /usr/sbin/iptables and inserts the ACCEPT rule above the FTP reject rules.

for example,
```
cp /etc/knockd.conf /etc/knockd.conf.bak && sed -i 's|/sbin/iptables|/usr/sbin/iptables|g; s|-A INPUT -s %IP% -p tcp --dport 21 -j ACCEPT && iptables -D INPUT -p tcp --dport 21 -j REJECT|-I INPUT 3 -s %IP% -p tcp --dport 21 -j ACCEPT|g' /etc/knockd.conf && pkill knockd; /usr/sbin/knockd -i eth0 -d
```

I finished pre-security and halfway through cybersecurity101, should i countniue down the path on thm fining my current course and next jr pen tester course. Or transtions to pwn college and take their core fundmentals courses like linux, computing 101 to understand computer architecture etc as prerequisite to learn c then go back on pwn college courses.

I am really passionate about vunreability research and low level concepts and like to learn about hardware and stuff, and i used thm pre and cybersecurity to build foundation to go to pwn college and take first steps to learning low level stuff.

Is that a good roadmap what are your thoughts?

What comes after I finish the PreSecurity path and get my certification?

Just finished this room and wanted to share a couple of takeaways.

The room walks through A01 (Broken Access Control), A07 (Identification & Authentication Failures), and A09 (Security Logging & Monitoring Failures), tying them back to the IAAA model — Identification, Authentication, Authorization, Accountability.

The hands-on part had me exploit an IDOR by just changing an id parameter in a URL to view another user's bank account data — found one with a $1M+ balance just by iterating through IDs 1-10. Simple exploit, but a solid reminder of how "broken access control" isn't some abstract concept — it's often just a missing authorization check on the backend.

Solid room for anyone starting out in web security. Currently working through the rest of the OWASP Top 10 series — anyone have recommendations for what to tackle next after this one?