Link to the room: https://tryhackme.com/room/hh-complimentary-05e0b604

Back at it for round three, and this time the trail leads straight through Cognito’s back door — the one login screen we never actually…

Git never forgets, even when you rewrite history to make it look like it did

Beyond the gate with a cookie the server never verified

This room a cloud focused room .

SSRF stands for Server-Side Request Forgery. It’s a vulnerability where an attacker gets a server to make a request it shouldn’t — to an…

A few months ago, I was conducting a penetration test on an enterprise system belonging to a municipality. The goal was to assess different…

Hacker Holidays 3rd Room date : 30 July 2026

Day 3 challenge of Hacker Holidays focused on a common cloud security issue: an AWS Cognito Identity Pool misconfiguration.

You can play this room for free: “https://tryhackme.com/room/hh-complimentary-05e0b604”

Introduction:

This is the walkthrough of THM Hacker Holidays-Day 01(The Concierge Knows Too Much) room, which demonstrates the prompt injection…

A 5-minute visual walkthrough of unsanitized inputs, payload mechanics, and parameterized queries.

TL;DR Cisco is warning about a Cisco FMC vulnerability under active attack. Tracked as CVE-2026-20316, it lets a remote attacker log in using a hidden static account. Cisco confirms exploitation, …

If you hear “hacker” and picture someone in a hoodie typing furiously in a dark room, it’s time to update that image. There’s a whole…

David Deutsch, AI and Offensive Security

I Broke an AI Chatbot’s Safety Filters Using Nothing but Arabic Small Talk How a joke about a password file turned into a full safety-filter bypass on one of the world’s biggest AI …

Room Name: Hacker Holidays: Day 3 — Complimentary

LeakNet claims it stole 11TB of NYC Health + Hospitals data containing sensitive medical, financial and biometric records linked to more than 12 million people.

Google has officially unveiled an upgrade for its native Gemini application on the macOS platform. Effective immediately, Mac users can seamlessly summon Gemini across any window interface. Simply…

At a glance Malware family Copybara (Android RAT) Operators Not attributed; kit uses Portuguese-language identifiers Targets N26 banking customers in Italy Delivery vector Vishing call, phishing l…