TryHackMe rooms
Corresponding practice
- On each room target, identify the input, processing context, and evidence of server-side impact.
- Build a comparison table for traversal, local file inclusion, remote file inclusion, and command injection.
- Confirm findings with the least disruptive room-provided test and avoid unnecessary commands.
- Add one prevention note for canonicalisation, allowlisting, safe APIs, and least privilege.
Evidence to capture
- Source/sink or input/impact notes
- Sanitised request and response evidence
- A concise remediation checklist
What I learned
Explain how the observed behaviour showed file access or command execution rather than a generic error.
Problems and dead ends
Record failed encodings, paths, or separators and what the response revealed.
What I will revisit
Repeat one validation technique without the room walkthrough.