TryHackMe rooms
Corresponding practice
- Build a small wordlist from clues supplied inside the room and deduplicate it.
- Capture the authorised login request and identify the protocol, fields, failure indicator, and rate-limit behaviour.
- Run the smallest effective Hydra test against the room target and record the exact scope and stop condition.
- Compare attempts, time, and result quality between the targeted and generic lists.
Evidence to capture
- Wordlist-generation and cleanup commands
- Sanitised Hydra command with target placeholders
- Notes on lockout, throttling, MFA, and recommended defences
What I learned
Explain why context and rate control matter more than blindly using a large list.
Problems and dead ends
Record false failure strings, incorrect form syntax, or connection issues.
What I will revisit
Rebuild the Hydra command from the captured request without copying it.