Search

Attacking Legacy Wi-Fi

Break WEP with a statistical key recovery attack and probe WPS for its PIN.

medium

Detecting NTDS Database Dumping

Learn how attackers dump NTDS, the heart of Active Directory, and detect it with logs and artifacts.

medium

Caido: The Basics

An introduction to using Caido to inspect and test web applications.

easy

Detecting SAM Hive Dumping

Learn the value of SAM dumping and see how to detect it using logs and artifacts.

medium

Critical Condition

THM Security Services has been engaged for a Detection Engineering activity for Cedar Hollow Health Network.

medium

Laravel TokenGuard: CVE-2026-114509

Bypass Laravel's TokenGuard with a non-string token (CVE-2026-114509), then detect and patch it.

easy

Proxy Meeting

Your payment is frozen and the AI assistant won’t help. Find a way to get it released.

medium

Privilege Escalation via Agent Chain

Trace an escalation that used no exploit, no stolen credential, and no compromised agent.

easy

Off the Brief

Trace how a vendor's guest account hijacked WorkCo's assistant and find what its mail carried away.

medium

The Trust Cascade

Chain a poisoned memory and a forged message across three agents to get data out of the estate.

medium

ASI01: Defending Against Agent Goal Hijack

Learn the nine OWASP mitigations that stop goal hijacking, from input filtering to drift alerts.

medium

The Rogue Pipeline

Trace one fault through TryTrainMe's agents, catch the approval trap and contain a rogue agent.

medium

ASI09: Human-Agent Trust Exploitation

Approve an agent's change, then find what its summary left out and fix the approval surface.

medium

ASI04: Agentic Supply Chain Compromise

How agents load components nobody vetted, and why approval belongs to a version.

medium

ASI01: Indirect Injection in Agentic Systems

Learn the different channels and mechanisms that can be used to deliver a payload to an agent.

medium

Securing the Tool and Identity Layer

Learn how to harden AI agent tools, identities, runtime components, and containment controls.

medium

Agentic Incident Response

Investigate agent artifacts, quarantine untrusted states, restore memory, and safely reintegrate.

medium

ASI08: Cascading Agent Failures

Trace a faulty result across agents, measure its blast radius, and stop it with a circuit breaker.

medium

Defending the Persistence Layer

Map nineteen agent controls to the attacks they close, then switch them on and read the logs.

medium

ASI10: Rogue Agents

Learn to detect, classify and contain rogue agents that drift beyond their authorised scope.

medium

ASI01: Agent Goal Hijack

See how one poisoned email let EchoLeak steer Copilot, and why an agent's goal is so easy to steal.

medium

ASI02: Tool Misuse & Exploitation

Learn how tools that are safe on their own can combine to make an agent compromised.

medium

ASI03: Agent Identity & Privilege Abuse

How AI agents end up acting under credentials they should not hold. Covers OWASP ASI03.

medium