Security lab walkthroughs, explained step by step

Rooms and labs solved and written up by Animesh Roy. Search for the one you are working on, or browse them by learning path.

Learning paths

SOC Level 2 Detection engineering, threat hunting, log analysis and incident response for analysts moving past triage. 63 rooms
Jr Penetration Tester Web hacking, network security, Metasploit and privilege escalation: the core skills for a first pentesting role. 58 rooms
Web Application Pentesting Authentication, injection and server-side attacks against web applications, with the reasoning behind each exploit. 29 rooms
Web Application Red Teaming Advanced web attack chains: SSTI, SSRF, deserialisation and other server-side techniques used on real engagements. 19 rooms
Pre Security Networking, operating system and web fundamentals for people starting from zero. 12 rooms

Latest walkthroughs

TryHackMe Anonymous: Writable FTP Cron to SUID env Root

Linux privilege escalation

Anonymous: Writable FTP Cron to SUID env Root

TryHackMe Event Horizon: Covenant C2 traffic decryption

network forensics

Event Horizon: Covenant C2 traffic decryption

TryHackMe Snort Challenge: blocking live attacks with IPS inline mode

Snort

Snort Challenge: blocking live attacks with IPS inline mode

TryHackMe Plant Photographer: SSRF to RCE via Werkzeug

SSRF

Plant Photographer: SSRF to RCE via Werkzeug

TryHackMe Warzone 1: MirrorBlast C2 traffic analysis

SOC Level 1

Warzone 1: MirrorBlast C2 traffic analysis

TryHackMe BreachBlocker Unlocker: timing attacks and 2FA bypass

AoC 2025

BreachBlocker Unlocker: timing attacks and 2FA bypass

TryHackMe Profiles: Linux memory forensics with Volatility 3

DFIR

Profiles: Linux memory forensics with Volatility 3

TryHackMe Overflow The Jackpot CTF: full chain walkthrough

CTF

Overflow The Jackpot CTF: full chain walkthrough

TryHackMe Juicy: XSS to SSRF via unsanitised LLM output

Attacking LLMs

Juicy: XSS to SSRF via unsanitised LLM output

TryHackMe Model Poisoning: supply chain and training data attacks

Attacking LLMs

Model Poisoning: supply chain and training data attacks