Cyberbits

  • Fuzzers

    Introduction Plenty of TryHackMe rooms have a task like “find the hidden login page,” and the answer is the same ritual every time: throw a wordlist of paths at the web server and see what sticks. I had been switching tools based on whatever the room walkthrough used, so I sat down to pick a…

  • Passing TryHackMe SEC1

    Introduction TryHackMe’s Cyber Security 101 (SEC1) is the platform’s foundational certificate; the step up from the SEC0 (Pre Security) path. One learning path, six domains, covering both sides of the fence: operating system skills, network traffic analysis, web application security, security operations, password attacks, and malware analysis fundamentals. The exam is scenario-based and fully hands-on,…

  • THM The Hollow Shell

    Introduction The Hollow Shell is another resort-themed box from TryHackMe’s Hacker Holidays run, and this one lives entirely in a zip file. Upload the wrong kind of archive to a “shell delivery” service and the server will happily write your files anywhere on disk it can reach. That’s Zip Slip, and this room chains it…

  • THM Do Not Disturb

    Introduction TryHackMe’s Do Not Disturb box chains five small vulnerabilities into one root shell: a NoSQL bypass into a staff console, a template injection field that runs code, a stray debug port, and a forgotten group membership that hands over the disk. Once again, this was a tough one for a beginning pentester. But it…

  • THM Beach Bar

    Introduction I’ve been working through TryHackMe’s Hacker Holidays 2026 event, a free 14-day run of rooms set in a five-star resort with a zero-star security posture. Beach Bar, a beginner Linux box, chains three real production mistakes: exposed credentials, remote code execution through unsafe YAML deserialization, and a root password sitting in plain sight. This…

  • Single Kali VM on Apple Silicon

    Introduction A few weeks back I built a throwaway lab: an attacker box and a couple of disposable targets, all from a make up. That solved the targets problem, but I wanted more for the Kali box itself. So I gave it the same treatment: one repo, one command, a Kali workstation I can burn…

  • Metasploit EternalBlue, Hearthbleed, i.e.

    Introduction A while back I wrote a beginner Metasploit post where I popped a Metasploitable box. Since then I’ve kept poking at things, and a few features finally clicked. So here’s a more intermediate follow-up; two classic exploits, the shell upgrade trick I now use and the post-exploitation moves that make the framework feel like…

  • Attacker workstation on a Mac

    Introduction I run my daily work off a MacBook, and for a while I told myself I could install nmap and a handful of tools straight onto macOS with Homebrew and call it a day. That works until the first time you run something you don’t fully understand yet against a target, on the same…

  • Metasploit for beginners + hack a Linux box

    Introduction Short course I found on Coursera giving me some Metasploit basics. Already covered a lot on THM. Expanded quite a bit on this short course, to be able to present to you the below write up. Setup Create a lab with: I’m running on a Mac. Recon Find out what we’re working with. Note:…

  • Install Metasploit on Mac with a database

    Introduction Kali Linux or ParrotOS are probably still the best ways to use Metasploit (in a VM or not) but I really wanted to give it a spin on Mac. It’s not too difficult, but there are a few caveats. First of all, we’ll have to update this guide after 01-09-2026: Deprecated because it does…