We use cookies to ensure you get the best user experience. For more information see our cookie policy.

error-icon
The room you tried to access doesn’t exist. Try searching for another one
error-icon
The room you tried to access doesn’t exist. Try searching for another one

Web App Pentester Level 1 (WEB1)

A hands-on certification that proves you can find, exploit and remediate real web vulnerabilities, across blackbox, whitebox and greybox.

WEB1 certification badge with cloud icon and TryHackMe branding.WEB1 certification badge with cloud icon and TryHackMe branding.

1,545 results

Web Frameworks: .NET
room

Web Frameworks: .NET

Review ASP.NET source, find the framework-specific sinks, and exploit each on the lab machine.

medium

Premium Walkthrough
WP2Shell: CVE-2026-63030
room

WP2Shell: CVE-2026-63030

Chain an unauthenticated WordPress SQL injection with a logic flaw to forge an admin and gain RCE.

easy

MAX Walkthrough
IronHold
room

IronHold

The source leaked. Read it like an attacker, chain the flaws, and shell the door-control server.

hard

Premium Challenge
GhostLock: CVE-2026-43499
room

GhostLock: CVE-2026-43499

Investigate GhostLock CVE-2026-43499, analyse Linux futex evidence, and plan kernel mitigation.

medium

MAX Walkthrough
Web Frameworks: Python
room

Web Frameworks: Python

Review Django and Flask source for framework-specific sinks, then exploit each on the lab machine.

medium

Premium Walkthrough
Web Frameworks: Java
room

Web Frameworks: Java

Review Spring Boot source, find the framework-specific sinks, and exploit each on the lab machine.

medium

Premium Walkthrough
Brr
room

Brr

You've been called in to assess an OT environment.

easy

Premium Challenge
SOC L2 Alert Triage
room

SOC L2 Alert Triage

Learn how to triage escalated alerts and respond to cyber threats.

easy

Free Walkthrough
AI & Automation in Detection Engineering
room

AI & Automation in Detection Engineering

Learn to automate detection rules development and how AI can boost this process effectively.

medium

MAX Walkthrough
Source Code Review: PHP
room

Source Code Review: PHP

Learn the basics of source code review for PHP.

easy

Premium Walkthrough
AI Security Threats
room

AI Security Threats

Explore the vulnerabilities AI introduces, how attackers exploit it, and how defenders fight back.

easy

Free Walkthrough
Web Frameworks: Code Review
room

Web Frameworks: Code Review

Read web app source like an attacker: trace user input to dangerous sinks, triage with Semgrep.

medium

Free Walkthrough
CVE-2026-46331: pedit COW
room

CVE-2026-46331: pedit COW

Exploit pedit COW, a copy-on-write flaw in the Linux kernel's packet-editing action.

easy

MAX Walkthrough
Fools Mate, Revenge
room

Fools Mate, Revenge

Do you have what it takes to defeat me and claim your prize?

medium

Free Challenge
Fools Mate
room

Fools Mate

Can you bypass the engine?

easy

Free Challenge
Advanced Packet Analysis
room

Advanced Packet Analysis

Triage alerts, reassemble streams, extract files, and detect protocol abuse via Wireshark & TShark.

medium

MAX Walkthrough
CTI for Alert Triage
room

CTI for Alert Triage

Explore how security analysts can use CTI in their daily operations.

easy

MAX Walkthrough
Threat Hunting: Introduction
room

Threat Hunting: Introduction

Learn the foundational concepts, approaches, and techniques of threat hunting.

easy

Free Walkthrough
NoScope: Finding RCE
room

NoScope: Finding RCE

NoScope found an Alf.io RCE zero-day (CVE-2026-35482). Exploit it manually and watch AI solve it.

medium

Premium Walkthrough
Senior Security Analyst Intro
room

Senior Security Analyst Intro

Explore the duties and exciting opportunities of a SOC Level 2 analyst.

easy

Free Walkthrough
The Oversharing Container
room

The Oversharing Container

A container without its own role inherits the host's. See how this is an issue of its own.

medium

Premium Walkthrough
The Leaky Metadata
room

The Leaky Metadata

IMDSv1 turns any SSRF bug into credential theft. Find it, fix it, and build without it.

medium

Premium Walkthrough
The Unpatched Instance
room

The Unpatched Instance

Patch debt accumulates silently. Learn to find, fix, and prevent it using Systems Manager.

medium

Premium Walkthrough
Showing 24 of 1545 results