Cyberbits

  • Fuzzers

    Introduction Plenty of TryHackMe rooms have a task like “find the hidden login page,” and the answer is the same ritual every time: throw a wordlist of paths at the web server and see what sticks. I had been switching tools based on whatever the room walkthrough used, so I sat down to pick a…

  • THM The Hollow Shell

    Introduction The Hollow Shell is another resort-themed box from TryHackMe’s Hacker Holidays run, and this one lives entirely in a zip file. Upload the wrong kind of archive to a “shell delivery” service and the server will happily write your files anywhere on disk it can reach. That’s Zip Slip, and this room chains it…

  • THM Do Not Disturb

    Introduction TryHackMe’s Do Not Disturb box chains five small vulnerabilities into one root shell: a NoSQL bypass into a staff console, a template injection field that runs code, a stray debug port, and a forgotten group membership that hands over the disk. Once again, this was a tough one for a beginning pentester. But it…

  • THM Beach Bar

    Introduction I’ve been working through TryHackMe’s Hacker Holidays 2026 event, a free 14-day run of rooms set in a five-star resort with a zero-star security posture. Beach Bar, a beginner Linux box, chains three real production mistakes: exposed credentials, remote code execution through unsafe YAML deserialization, and a root password sitting in plain sight. This…