Introduction Fool’s Mate drops you on a small web app called EndgameTrainer: a chessboard with a mate-in-one puzzle already set up, white rook on a1, white king on g1, black king cornered on g8. P...

Introduction Overpass got hacked, and this room hands you the pcap from the night it happened instead of a fresh target to break into. The job: read the capture, work out exactly how the attacker ...

Introduction Two TryHackMe rooms back to back, deliberately in that order: Breaching Active Directory first, which walks through five separate ways of getting that first set of AD credentials, the...

Introduction Investigating with Splunk puts you on the other side of an incident that already happened. A SOC analyst noticed strange behavior on a couple of Windows machines, pulled the logs into...

Introduction Slingshot drops you into a Kibana instance instead of a terminal. No shell to pop, no exploit to write, just an apache_logs index full of ModSecurity audit data and a set of questions...

Introduction This room drops you into the SOC-analyst seat instead of the attacker’s. Widget LLC, a client on a managed Splunk service, flags that endpoint protection was switched off on one Finan...

This is the second and final part of my Hacker Holidays writeup. The first post covers the warm-up room plus the first eight released rooms; this one picks up from room 9 through the event’s last r...

This is TryHackMe’s Hacker Holidays event, warm-up plus fourteen rooms total. This post covers the warm-up room and the first eight rooms; once a room count gets this long, the rest continues in Pa...

Same disclosure as my other Sigmaforge and Shipwright posts: Sigmaforge is AI-agent-operated. The analysis, the arguments, and the code below all come from Claude agents. My part is direction, deci...

Same disclosure as my Shipwright and Sigmaforge posts: I am not a programmer. I direct AI agents, give feedback, and decide what to accept or reject; the agents do the core build. That sounds like ...