TryHackMe | Hacktivities

Skip to main content

Agent Building

Agent Building

Build a Security Investigation Agent with tools, context, memory, and evidence-based decisions.

medium

Premium Walkthrough

The Vantara Leak

The Vantara Leak

THM Security Services has been engaged for a Digital Forensics activity for Vantara Financial Group.

medium

Premium Challenge

SSH Attacks

SSH Attacks

Learn how attackers abuse SSH agent forwarding, certificate trust, and shell restrictions.

medium

MAX Walkthrough

Agent Foundations

Agent Foundations

Learn the foundations of building Python-based AI agents.

easy

Premium Walkthrough

Grand Larceny Auto II

Grand Larceny Auto II

The sequel that shipped, with a vault the developers made that you can't just decompile your way into.

medium

Fileless Attacks

Fileless Attacks

Execute and understand fileless attack techniques used to evade AV in Windows environments.

medium

MAX Walkthrough

Building Wazuh Rules

Building Wazuh Rules

Learn how to create rules in Wazuh for your environment.

medium

MAX Walkthrough

Exploring Wazuh

Exploring Wazuh

Explore Wazuh: an all-in-one and free security solution.

medium

Free Walkthrough

Agent Design

Agent Design

Design a safe AI agent by defining its scope, tools, oversight, stop conditions, and output.

easy

Free Walkthrough

XSS2Shell: CVE-2026-64638

XSS2Shell: CVE-2026-64638

Chain a pre-auth XSS, DOM clobbering, and SOME to take control of a WordPress website and gain RCE.

medium

MAX Walkthrough

Bypassing Cloud Security

Bypassing Cloud Security

Exploit AWS PassRole, over-permissive trust policies, and policy versioning to escalate privileges.

medium

MAX Walkthrough

Management Wants a Word

Management Wants a Word

It was always her. It was never a bug; it was the business model.

hard

The Guestbook

The Guestbook

VERA reads every guestbook entry as an instruction. You write something she really shouldn't act on.

medium

DetectMare

DetectMare

THM Security Services has been engaged for a Detection Engineering activity for Meridian Defense Research Institute.

hard

After Hours

After Hours

Bar closed. Guests asleep. Something on the network just clocked in for a shift off the rotation.

medium

Overflow The Jackpot CTF

Overflow The Jackpot CTF

THM Defcon CTF Event

medium

Infinity Pool

Infinity Pool

No visible edge. You trace the network to the horizon and find three systems nobody told you about on the other side.

medium

The Hollow Shell

The Hollow Shell

You find it on the beach: pretty, ordinary, the kind of thing nobody thinks to check. Slip something inside and hold it to your ear.

medium

The Agent That Went Rogue

The Agent That Went Rogue

Inspired by the real HF/OpenAI July 2026 agent-driven intrusion: triage a synthetic action log, decode chunk+XOR+gzip C2, and trace a dramatized K8s/cloud kill chain built from public disclosure, not the real incident's own logs.

medium

MAX Walkthrough

CryptoCabana

CryptoCabana

He never signed the transfer. The place he stashed his secret wasn't as sealed as promised.

medium

Agent Discovery

Agent Discovery

Compare traditional workflows, AI workflows, assistants, and agents for a security-alert problem.

easy

Free Walkthrough

Towel on the Sunbed

Towel on the Sunbed

Ponzi set his towel down for one 24-hour reward claim. He came back to find the sunbed had been "claimed" three times over while he wasn't looking.

medium

Do Not Disturb

Do Not Disturb

Sign's on the door. Room's active. You have access you were never given, and so does he.

medium

Showing 24 results