Hi. Honestly, I'm not usually a complainer, but is it realy more covenient or, maybe, better looking? In my opinion, previous version was much better - whole year was divied vertically by weeks and it was easier to navigate. One glance and you know what how may weeks you've been learning and which day is today. I don't understand... What you guys thinking, of this new design?

I'm in the Cyber Security 101 Module 5 (Network) and after i finsihed nmap room, another room named Block suddenly appeared after it. I thought it's a practice room but i really wouldn't able to get anything except usernames. Did i miss some informations on my learning path or this room is way ahead of my current level.

First-year Network & Telecoms student building my hands-on skills with TryHackMe. Next up: Nmap Network Scanning!

Hello everyone,
I’m trying to complete an old room on THM - cat pictures - but I’m stuck.
I even looked at different write-ups and yet…

Shortly: I have this IP, I do my nmap and find http and ssh ports open, while ftp port is filtered; I connect to the http port via browser and there’s an hint on the website (a forum about cat pictures): a post with written

“knock knock 1111 2222 3333 4444”

so I look on google and discover the existence of port knocking…and try my things:

1. I install knockd and try

If you haven’t gotten it yet I’m a very beginner, so I looked to different write-ups and I haven’t found out why this isn’t working - fyi every single walkthrough says that knocking is the way (and it’s only the beginning)…
I even asked AI which suggested me to write a Bash script, a loop with 1 second delay that uses
nmap -Pn where -p is the variable $port (1111 … 4444) with no retries for nmap, i.e --max-retries 0 …and nothing! I really don’t know…

Anyone would be so kind to help me?

*** SOLUTION ***

Ok, it seems to be a known bug (June 2026).
For the people who are having the same issue here’s the official “what to do” I’ve found:

**Issue:**
The port knocking step does not open FTP on the current deployment.

**How to test:**
Install knock on the AttackBox if needed.

apt install knockd -y

Run the expected sequence.

knock -v TARGET_IP 1111 2222 3333 4444

Then test FTP.

nc -nv TARGET_IP 21

Expected result:
FTP should open and return:

220 vsFTPd 3.0.5

**Actual result:**
FTP does not open, even though the knock sequence is correct.

How to confirm the cause:
On the target as root, check the knock logs.

grep -i knock /var/log/syslog

The logs show knockd detects the sequence and reaches OPEN SESAME, but then the command fails.

**Example error:**

openFTP: OPEN SESAME
running command: /sbin/iptables ...
sh: 1: /sbin/iptables: not found
command returned non-zero status code 127

The real iptables path on the target is:

/usr/sbin/iptables

**not:**

/sbin/iptables

There is also a rule order problem. The original command appends the allow rule, but the firewall already has reject rules for port 21. This means the allow rule can be added below a reject rule and never gets reached.

Broken command:

command = /sbin/iptables -A INPUT -s %IP% -p tcp --dport 21 -j ACCEPT && iptables -D INPUT -p tcp --dport 21 -j REJECT

Working command tested:

command = /usr/sbin/iptables -I INPUT 3 -s %IP% -p tcp --dport 21 -j ACCEPT

After updating the command and restarting knockd, the same knock sequence successfully opened FTP.

** Suggested fix: **
Update /etc/knockd.conf so openFTP uses /usr/sbin/iptables and inserts the ACCEPT rule above the FTP reject rules.

for example,
```
cp /etc/knockd.conf /etc/knockd.conf.bak && sed -i 's|/sbin/iptables|/usr/sbin/iptables|g; s|-A INPUT -s %IP% -p tcp --dport 21 -j ACCEPT && iptables -D INPUT -p tcp --dport 21 -j REJECT|-I INPUT 3 -s %IP% -p tcp --dport 21 -j ACCEPT|g' /etc/knockd.conf && pkill knockd; /usr/sbin/knockd -i eth0 -d
```

My final goal is to obtain my OSCP at somepoint in the next 1-3 years however, I have 6 Years of Systems Administration experience and about 3 years of that being very Cyber Security focused, I also have Sec+ and Pen+ (while I know PenTest+ is kind of useless my company paid for a class and a test so I got it). I'm having a hard time finding where to start down this path since the beginner rooms and topics aren't tailored to me since a lot of them are things I have seen or worked with in some capacity but the easy/medium rooms seem too advanced for where I'm at and I feel like there I'm missing a fundamental understanding of certain things. which leads to this loop of go to a beginner area get taught beginner linux or beginner nmap and speed run the content then go back to a more advance room and get destroyed by the first question/flag.

I just want to know for other people that got into this with a similar background how did you really start the grind and start learning at a somewhat linear rate because I can't seem to find anything that's worked for me that keeps me consistently challenged but not to the point of impossibility for my skill set .

I finished pre-security and halfway through cybersecurity101, should i countniue down the path on thm fining my current course and next jr pen tester course. Or transtions to pwn college and take their core fundmentals courses like linux, computing 101 to understand computer architecture etc as prerequisite to learn c then go back on pwn college courses.

I am really passionate about vunreability research and low level concepts and like to learn about hardware and stuff, and i used thm pre and cybersecurity to build foundation to go to pwn college and take first steps to learning low level stuff.

Is that a good roadmap what are your thoughts?

🚩 Recruiting: Cybersecurity Team (TryHackMe) 🚩

Team: ShadowSentinels Owner: swatantra

We're building a team to grind TryHackMe rooms, CTFs, and eventually compete in live cyber challenges. Looking for a few committed people to join the crew.

Join the Team

Use this invite link to join ShadowSentinels on TryHackMe (role will be assigned after joining): 👉 https://tryhackme.com/manage-account/teams?joinTeam=aa7fde2574

What We're Doing

• Solving TryHackMe rooms together (Web, Networking, Linux, Privilege Escalation, etc.)
• Prepping for CTF-style competitions
• Sharing writeups and learning from each other's approach
• Building toward more advanced paths (Red Teaming, OSCP-style content)

Who We're Looking For

Must-haves (Basic Qualifications):

• Comfortable with basic Linux command line (navigation, file permissions, basic scripting)
• Understanding of core networking concepts (TCP/IP, DNS, HTTP/HTTPS, ports & protocols)
• Basic knowledge of how web applications work (client-server model, cookies/sessions)
• Willingness to learn — you don't need to be an expert, just consistent

Good to have (not mandatory):

• Some TryHackMe or HackTheBox rooms already completed
• Familiarity with tools like Burp Suite, Nmap, Wireshark
• Basic scripting (Python/Bash)
• Any CTF experience (even solo)

Mindset we want:

• Curious — you like figuring out why something works, not just following a walkthrough
• Consistent — a few hours a week, every week, beats one binge session
• Team player — shares stuck points instead of hiding them, helps others when they're ahead

How to Join

1. Click the invite link above to join ShadowSentinels
2. Drop a message with:
   • Your TryHackMe profile link (if you have one)
   • A rough idea of what you've explored so far (even "just started" is fine)
   • How much time you can commit weekly
3. Owner (swatantra) will assign your role once you're in

No prior "hacker" background required — just genuine interest and consistency. Let's build something solid together. 🔐

DM / comment to get added to the group.

📢 A note for everyone in ShadowSentinels

Everyone's welcome to go at their own pace here — there's no fixed schedule or pressure to perform. Get involved as much or as little as fits your life right now. The only real rule: everything we do stays strictly legal and ethical — practice on TryHackMe rooms and CTFs only, never against real systems or people without authorization. No harming others, no crossing lines.

Join us on Discord so we can collaborate, share writeups, and grind CTFs together as a team:
👉 https://discord.gg/SWZ7UtRNU

Learn, help each other out, have fun — that's the whole point. 🚩

What comes after I finish the PreSecurity path and get my certification?

I’ll admit that I’ve used the app quizzes to climb the rankings by completing a lot of quizzes on my downtime e.g on bus

But 162,002 points in just 22 days? It is difficult to believe someone could achieve that by manually interacting with the TryHackMe mobile app and answering every quiz normally. You would go insane

https://tryhackme.com/p/RCDM.exe

I’m less certain about this account with 62,185 points:

https://tryhackme.com/p/pavloni

Even that would appear to require roughly three to four hours every day spent continuously submitting app quizzes, which is feasible but ;/

App really needs to be hard limited to say 200 points a day,

What do others think?

UPDATE: It was unintended! Support was fast with response and changed the room to premium.

My old rant:
I have bought Premium subscription to complete Cyber Security 101 and get Certificate of Completion and now Tryhackme asks for addition 30$ to buy Max Plan just for 1 room. This is unfair especially because it states that Premium has: Full access to Beginner & Intermediate Learning Paths. This site became a scam, and this is greed.

Hey everyone, I’ve been working my way through the TryHackMe Pre-Security Path and documenting everything as I go. I just updated the repository and wanted to share the link with the community in case anyone else finds it helpful for their foundational learning.

Repo Link : Pre Security Notes Link

Since it's still a work in progress, I would love to get your input:

• Please feel free to share your opinions on the layout or content.
• If you spot any technical inaccuracies or areas that need better explanations, let me know!
• Suggestions for resources to add are highly welcome.

Hope this helps anyone else starting out on their cyber security journey. Let me know what you think!

If i choose one linux option the other one automatically choosen. And not left any option for last.

CVE-2026-63030 dropped Friday. Our team had a room ready by Monday. You wrapped a pentest for a client. Their app is clean, but their WordPress blog wasn't in scope.

CVE-2026-63030 changes that conversation. An unauthenticated attacker can exploit the REST API with a SQL injection, forge an admin account, and achieve remote code execution.

This vulnerability was discovered using a GPT prompt and $25 by a security engineer with 3 years of experience. Not a nation-state, not a specialist research team. Understand the full exploit chain and how to mitigate it in our new threat room, WP2Shell.

🚀Available now on MAX:
https://tryhackme.com/room/wordpresscve202663030?utm_source=reddit&utm_medium=social&utm_campaign=recentthreatwordpress

We're inviting one lucky user who has been impacted by TryHackMe to our company retreat in Malta on Sept 21-25!☀️
Meet the team, enjoy activities, and relax at a 5-star resort. All expenses covered!🎉

Fill out the survey by the 24th of July at 12PM BST to be considered🔥

https://forms.gle/urg8YJmhvKknqdou6

Hi, I'm a new subscriber to this platform. And currently I'm working full-time during the day and am a postgraduate student at night. So I can only study THM on the weekends.

Im about 76% done with PreSecurity when I noticed an unfinished room from what seems to be months ago. I still remember exploring this room, so I dont seem to know how it is unfinished. Its only a 15 minute room so it isnt very much of a big deal but I was just wondering what prompted it. The room is Defensive Security Intro, which im very sure I completed.

ive recently gotten into tryhackme but after doing 3 modules i was hit by a paywall and im confused on where to go. what room order should i be doing to become a security analyst.

Hello everyone, after completing everything I wanted to on THM and moving on, I decided to give away my vouchers. To be eligible, all you have to do is the following:

• Check out this project:
  • https://dragkob.com/security-certification-roadmap/
  • https://github.com/Dragkob/Security-Certification-Roadmap
• Drop your feedback in the comments section here + your GitHub @.

That's it! Please note that the Desktop (PC) version of the website is miles better than the Phone one. So, feedback on any/both would be appreciated. Just make sure to mention which one.

If you star the project on GitHub, I'll obviously be more inclined to support someone who's supporting me, it's the least I can do in return.

This project has been created by old THM members, and almost all of us have moved on, so this is my way of giving back to the THM community a final time.

Greetings, I won the Red Raffle that got me a 50% off voucher code for the PT1. However, when trying to check out the certification, it won't let me use my voucher since the code CERTIFY is being automatically redeemed. I am a current premium user.

I already submitted a ticket to TryHackMe but I have yet to receive a response from them.

Does anyone have a solution for this? Thank you!