Skip to main content
TryHackMe | Hacktivities

1,510 results

Kaboom
room

Kaboom

You've been called in to assess an OT environment.

medium

Premium Challenge
secure-ai-systems
module

Secure AI Systems

This module explores AI systems as an attack surface, covering secure architectural design principles and how to identify weaknesses at the system integration layer. Learners examine LLM-specific security concerns, apply threat modelling frameworks like STRIDE and OWASP in AI contexts, and practice attack surface discovery when AI components are present. The module concludes with a static site exercise where learners put their AI threat modelling skills to the test.

ai-fundamentals
module

AI Fundamentals

This module introduces learners to the foundational concepts of artificial intelligence and machine learning, establishing the mental models needed before diving into security topics. Rooms cover AI/ML threat categories, how models consume and process data, prompt engineering basics, and how AI can be used to augment existing roles using digital forensics as an example with a companion challenge to close off.

prompt-security
module

Prompt Security

This module covers one of the most prevalent AI attack classes: prompt injection. Learners begin with direct injection techniques before moving on to jailbreaking and instruction smuggling via external content. The module then shifts to the defensive side, covering hardening techniques including filters, guards, and template isolation. Two challenge rooms provide hands-on red experience, reinforcing both attack recognition and mitigation strategies.

ai-supply-chain-security
module

AI Supply Chain Security

This module focuses on the security of AI models from procurement through deployment. Learners investigate how supply chains are targeted (OWASP LLM03), how to detect tampered or untrusted artefacts at ingestion, and how embedded triggers, poisoned checkpoints, and compromised fine-tunes manifest in real-world scenarios. Two hands-on challenge rooms reinforce defensive skills in identifying and responding to malicious models.

data-poisoning
module

Data Poisoning

This module descends into the deepest layer of AI security: the data. Learners explore risks specific to Retrieval-Augmented Generation (RAG) systems, attacks targeting ingestion pipelines and embeddings, and how private data can be exposed through retrieval or embedding leakage. Mapped to OWASP LLM02, LLM04, and LLM08, the module closes with two scenario-based challenges centred on RAG poisoning detection and defence.

2026anaiodysseyrj20j
module

2026: An AI Odyssey

Module containing all event rooms for the "2026: An AI Odyssey" CTF

jr-pentester-challenges
module

Jr Pentester Challenges

This module is the capstone of the path. Four full-scope challenges put every skill you’ve built into action against environments designed to mirror real penetration tests, with no guided walkthroughs to lean on. You’ll move from reconnaissance through exploitation, privilege escalation, and lateral movement on your own, working through targets that get progressively more demanding as you go. Completing them proves you’re ready to operate at the junior pentester level.

network-reconnaissance
module

Network Reconnaissance

Reconnaissance is where every engagement begins, and this module covers both halves. You’ll start with passive techniques that mine public records, search engines, and DNS data without ever touching the target, then move into active probing with classic network utilities to map live systems. From there, you’ll work through the everyday protocols and services that keep networks running, learning how each one behaves and how attackers turn its quirks against it.

penetration-testing-foundations
module

Penetration Testing Foundations

This module drops you straight into the action with two guided engagements: one against a web application and one against a vulnerable machine. You’ll walk through each attack from reconnaissance to exploitation, see how the cyber kill chain structures attacker thinking, and meet the industry-standard frameworks that shape professional engagements. By the end, you’ll have the working mental model every penetration test relies on.

web-application-vulnerabilities-i
module

Web Application Vulnerabilities I

This module walks you through five of the most impactful vulnerabilities in modern web applications, examining how each works, why it persists, and how attackers exploit it in the wild. You’ll start with the classics, SQL injection and cross-site scripting, before moving to subtler bugs like CSRF, SSRF, and IDOR that often slip past even experienced developers. A final hands-on challenge brings all the techniques together, so you finish the module able to spot these issues quickly and exploit them with confidence.

web-application-vulnerabilities-ii
module

Web Application Vulnerabilities II

This module takes your web hacking beyond the classics into the vulnerabilities that turn small oversights into full-system compromises. You’ll begin with the mechanics of session management and authentication, then move on to server-side attacks such as directory traversal and command injection, and finish with the rapidly expanding attack surface of modern APIs. A live security challenge closes the module, so the techniques are battle-tested before you carry them into the rest of the path.

vulnerability-knowledge
module

Vulnerability Knowledge

This module is about how penetration testers stay ahead of the curve, starting with the public vulnerability databases (CVE, NVD, vendor advisories) that catalog every known weakness in modern software. You’ll then move into the scanning tools that do the heavy lifting at scale, before picking up the manual identification techniques that turn raw scanner output into reliable, actionable findings. By the end, you’ll know how to research a CVE from first principles and validate whether it actually applies to a target.

password-attacks
module

Password Attacks

This module steps into the attacker’s playbook for stealing and cracking credentials, opening with phishing, the social engineering classic that still catches cautious users off guard. From there, you’ll run online attacks with Hydra, build custom wordlists tailored to a target, and use them to crack captured password hashes offline. A live password challenge closes the module, putting every technique into a realistic credential attack chain.

metasploit-and-exploitation
module

Metasploit and Exploitation

This module covers exploitation from two complementary angles: Metasploit, the framework that powers countless real-world engagements, and the manual craft that underpins it. You’ll work through Metasploit from the ground up, learning to scan for vulnerabilities, exploit live systems, run post-exploitation modules, and generate custom payloads with msfvenom. From there, you’ll move beyond the framework to build your own shells, listeners, and payloads from scratch, so you can weaponize an exploit whether a framework is on the table or not.

active-directory-security-testing-basics
module

Active Directory Security Testing Basics

Active Directory sits at the heart of nearly every corporate network, which makes it one of the most valuable targets in any engagement. This module takes you behind the scenes, starting with how AD authentication actually works under the hood before walking through the full attack chain: breaching the domain, enumerating users and machines, harvesting credentials, and moving laterally to expand your foothold. Two live AD challenges close the module, so the full chain is something you’ve executed end to end.

specialized-domains
module

Specialized Domains

This module branches out beyond the core pentesting path into the specialized domains shaping modern cyber security. You’ll explore wireless, mobile, and cloud security to see how each environment introduces its own attack surface, step into the rapidly emerging world of LLM pentesting, and shift perspective to see how defenders tackle the same problems through the blue team lens and DevSecOps practices. By the end, you’ll have a clear picture of where the field is going and which specialization might be right for you.

python-scripting-basics
module

Python Scripting Basics

Python is the go-to scripting language for penetration testers and the engine behind countless security tools used in the wild, and this module takes you from zero to writing your own. You’ll start with a guided demo to get a feel for the language, move into core programming concepts (variables, control flow, functions, data structures), and build your first standalone scripts. The module finishes with scripts tailored to real pentesting work, so the language becomes a tool you can actually reach for on an engagement.

pentesting-methodologies-and-reporting
module

Pentesting Methodologies and Reporting

This module covers the professional workflow that turns hacking skills into a real engagement. You’ll start with threat modeling and scoping, the planning work that happens before a single tool runs, then move into writing clear, actionable pentest reports that communicate findings to both technical and non-technical audiences. The module closes with the re-testing process, which verifies remediations and signs an engagement off, leaving you with an end-to-end view of how professional pentests are actually delivered.

privilegeescalation
module

Privilege Escalation

This module is about turning a foothold into full control of a system. You’ll begin with host configuration reviews, learning to spot the misconfigurations that make privilege escalation possible in the first place, then dig into Linux privesc through manual enumeration, common vectors, and automated tooling. From there, you’ll cross into the very different world of Windows privilege escalation, before two live challenges put every technique into practice across both operating systems.

incident-response-lifecycle
module

Incident Response Lifecycle

Incident response is not just a process on paper. In this module, you will work through a complete security incident at a company from start to finish, following the NIST incident response lifecycle across four rooms. Each room covers one phase of the lifecycle, building on the last, with every finding carrying forward into the next. By the end, you will have worked a real incident end to end the same way an IR analyst would on the job.

Defensive Security Trends
room

Defensive Security Trends

Explore the modern security landscape and learn from emerging trends.

easy

Premium Walkthrough
Showing 23 of 1510 results

We use cookies to ensure you get the best user experience. For more information see our cookie policy.