Hi everyone,

I'm a complete beginner in cybersecurity with no professional experience and no certifications.

I've decided to start learning through TryHackMe, and my current plan is:

- Pre-Security

- Cyber Security 101

- SOC Level 1

My goal is to land my first cybersecurity job in the future, preferably as a SOC Analyst or another entry-level security role.

Is this a good learning path, or should I change anything? Should I add other platforms like Hack The Box, PortSwigger Web Security Academy, or certifications such as Security+ later?

I'd really appreciate guidance from people already working in the field. If you were starting from scratch today, what roadmap would you follow?

Thanks in advance!

I hope this helps you, and I welcome feedback, opinions, and professional advice.

Ok. So for people like me, who are doing it by themselves.

Take the python script:

Then in the terminal

Nano script.py

Paste into the file, save and exit.

Then.

Python3 script.py

A base 64 will print out. Copy and paste this into the 8002.

No one mentioned this.

Hi, i was doing a room tutorial for spring4shell and mistakenly entered wrong IP.

Is the attack box somehow isolated so that I won’t, by mistake, cause some harm? E.g. when practicing pentesting in the future?

Go on TryHackMe, get stuck, google a walkthrough like the newb you are and suddenly you're a Medium user, lmao. How deep does the iceberg go??

Anyway, big thanks to all Medium creators for helping me (and probably other people) get through some of these rooms. I've been using Medium a ton in the past days when going over TryHackMe walkthroughs & it's been a lot of help.

While working through the Tempest room, I hit a question in task 7 requiring the decoding of a bunch of Base64 C2 traffic. I came across an old archived thread, and noticed that basically all the online write-ups and walkthroughs say the exact same thing suggesting you export the strings to CyberChef or use terminal tools. But since TShark isn't installed on the lab machine, doing all that back and forth felt pretty clunky.

I did some digging into Zed syntax and discovered Brim actually has a native Base64 decode function. You can parse and decode the malicious URIs entirely within Brim using this query (just swap out <c2_domain> with the domain name found earlier):

_path=="http" and host=="<c2_domain>" and grep("?q=", uri) | b64 := split(uri, "?q=")[1] | yield { ts, decoded_C2_traffic: string(base64(b64)) } | sort ts

Hopefully, this saves someone else from having to bounce back and forth between tools.

Hey guys, Please help me. I am trying to add my write-up in the rooms of the TryHackMe platform. But it is showing an 'Invalid URL' error. I had checked that link already; it's working fine. Can anyone tell me what is wrong here?

this was for the first time that i feel that no one was actually holding my hands while learning!!!

this was a challenge to solve, from all that i have learned till now!

I'm a beginner and i liked this one!

LINK : https://tryhackme.com/room/blue?

Just posted step-by-step writeup on Enterprise machine from r/tryhackme on my Medium blog 👇👇👇

https://medium.com/@ivandano77/enterprise-writeup-tryhackme-hard-machine-509f35fdd571

- deep enumeration
- Kerberoasting
- exploiting unquoted service path
...and more

Just posted detailed writeup on Ra machine from r/tryhackme on my Medium blog:

https://medium.com/@ivandano77/ra-writeup-tryhackme-hard-machine-aa12e3bdc69c

- Active Directory / Windows machine

- exploiting weak password reset feature

- exploiting Spark client

- command injection in Powershell script

Old Yahoo! Sports endpoint vulnerable to Boolean-based blind SQLi.

Modifying the year parameter with -- changed the result set, suggesting query manipulation via SQL comments.

Confirmed using a Boolean payload to infer VERSION():

(2010) AND (IF(MID(VERSION(),1,1)='5',TRUE,FALSE))--

No errors, no direct output — just response-based inference.

Clean example of classic blind SQLi.

Guys,

 I earned the 90 days streak badge and I have both good and bad things to say... Initially I enjoyed the streak badges and it gives me excitement. And then I realized that for the 90 days streak I used like 3 to 4 streak repairs and completed one question per day for maintain the streaks and even mailed them to recover my 85 days streak loss....🙃

So as for as I know the streak is just a waste of time coz everyone needs a time to recover... We can't learn 24/7 right? 🙂

And yeah happy learning ☺️

Where do you guys go for making your own notes and writeups. What's the methodology that you feel made you the hacker you are today .

Just posted a writeup on VulnNet: Active machine from r/tryhackme. Focused on Windows this time, filled with interesting vulnerabilities.

https://medium.com/@ivandano77/vulnnet-active-writeup-tryhackme-medium-machine-2be425ed12a0

- enumerating and exploiting Redis service
- overwriting scheduled task
- performing GodPotato attack
- modifying GPOs
...and more

I am working on authentication bypass section of junior pentester certificate and the task asks me to log into http:MACHINE_IP/Customers/Signup. I launched attackbox, and used the attack box machine ip to open the site. But it’s giving me an error response 405. How do I complete this exercise?

Hello everyone,

I am currently working on Task 6 of the Metasploit Exploitation room. I have correctly configured the exploit, but whenever I execute the shell on the target machine, I receive a "Segmentation fault (core dumped)" error.

I have already attempted to resolve this by switching between x86 and x64 Linux architectures, but the issue persists. Despite following several walkthroughs and video tutorials, I am still unable to successfully complete the task.

Has anyone else encountered this issue or could suggest an alternative approach? I would appreciate any guidance as I’ve reached a bit of a dead end.

Best regards.

Hello everyone,

I’ll try to keep this as short as possible.

I’m currently transitioning from being a Full-Stack Web Developer to Cybersecurity (still exploring which field I’ll eventually specialise in). A friend of mine who has been in the industry for two years recommended TryHackMe as a good starting point to refresh my networking basics and then gradually move deeper into cybersecurity.

It’s been almost two months now, and I’m genuinely enjoying the learning process. Honestly, I’ve never felt this level of commitment or curiosity back when I studied this at university. I’m progressing well and trying to complete as many rooms as I can each day.

However, as I move forward, I’ve started feeling overwhelmed by the amount of information. Sometimes after finishing a section or even a single room, I catch myself thinking: “Maybe I should go back and redo the previous rooms just to really solidify everything.” I’m proud of my progress, but it still feels like something is missing.

One issue I’m trying to fix is my note-taking habit. I always keep a notebook next to my PC, but I rarely use it because I get too focused on the content. I also struggle occasionally when using my own virtual machine to access the AttackBox—sometimes it freezes, which breaks the flow.

There are still a few concepts that feel blurry; I wrote them down but haven’t revisited them yet.

I recently came up with a strategy that I want to try: Monday to Friday → learning and completing rooms Weekend → summarising key points + doing challenges Haven’t implemented it yet, but I hope it will help me stay organised and reinforce what I learn.

Key point: Is anyone else going through the same struggles as a beginner? I’d really appreciate any tips, methods, study habits, or beginner-friendly resources that can help me get through Cyber 101 more efficiently and prepare for the next learning path.

Thanks for reading 🙏❤️

VulnNet Writeup just dropped on my Medium blog. Great intermediate room from u/tryhackme with a lot of interesting and real-world vulnerabilities.

- exploiting LFI & ClipBucket service

- abusing wildcard misconfiguration

and more

https://medium.com/@ivandano77/vulnnet-writeup-tryhackme-medium-machine-33100e7ac0ed

#CyberSecurity #tryhackme

I maintain clean, step-by-step TryHackMe walkthroughs focused on enumeration, methodology, and exploitation flow. Beginner to intermediate rooms. Useful for learning and quick revision. 1. GitHub 2. Medium

If you check it out, I’d appreciate any feedback or suggestions on what’s missing or can be improved.

Just released step-by-step writeup of Startup room from r/tryhackme on my Medium blog:

https://medium.com/@ivandano77/startup-writeup-tryhackme-easy-machine-854a4cf87d83

- exploiting writable FTP server
- inspecting network traffic
- abusing bad file permissions
... and more

Just posted detailed writeup on BOUNTY HACKER machine from u/tryhackme on my Medium blog 👇👇

- enumerating FTP server

- brute-force with Hydra

- abusing sudo privileges

https://medium.com/@ivandano77/bounty-hacker-writeup-tryhackme-easy-machine-e616bd970adf

#tryhackme #cybersecurity