Howdy.

Continuing to write about my progression through THM's current daily CTF challenge event, following up after the first day's trivial "challenge".

For those unfamiliar, TryHackMe is a cybersecurity education platform, a bit like HackTheBox, except I've found them more focused on structured learning flows whereas HTB is more CTF-focused at least the based on the last time I've compared them. THM still has CTF events, however, and this is one of them.

I have plans to write more and more often (for myself and publicly), and have more to say about this endeavor and my experience as an autodidact in general, but I'm not finished writing that post (or those posts?) yet.

By posting this I'm basically tricking myself in continuing to write the rest to conclusion.

Day 02 - Room 404

This one was also rated Very Easy but at least required a little bit more than simply being an impostor for some chatbot AI and then asking for the flag.

The challenge provided an "AttackBox" as usual to run the challenge from and a target machine's IP address.

The introductory story and information noted that port 8080 was left wide open. The challenge was also tagged with "directory enumeration". Knowing these tidbits of information, I guessed that the route to take was to prod at the target machine and search for exposed directories.

The exposed directory ended up being a /.git/ repository.

From there, I dumped the exposed repo locally to scour and scavenge through, but things ended up being simpler and didn't require much scavenging. The flag was in the README.md in a warning not to deploy that folder to production. Someone had one job and done goofed.

Full writeup here:

https://nichrome.xyz/writing/hh2026-02-r404/

Conclusion & Takeaways

The first few days have been a lot of winging it in terms of process, and by day 4-5 my workflow through these, my process became more structured for the purpose of learning and notetaking. Will elaborate on it in time, but it worked pretty well so far.

Until the next time.

Cheers.