TryHackMe rooms
Corresponding practice
- Build an endpoint inventory with method, path, authentication requirement, parameters, and expected response.
- On the room targets, test object-level and function-level access with two identities where provided.
- Attempt Support independently for 45 minutes before using a hint.
- Record rate-limit, validation, error-handling, and authorisation observations separately.
Evidence to capture
- Endpoint inventory
- One normal/modified API request comparison
- Support attack log and remediation note
What I learned
Explain how API testing differs from testing browser-rendered pages.
Problems and dead ends
Document any undocumented endpoint or parameter that was difficult to discover.
What I will revisit
Repeat the Support chain independently if a hint was needed.