--- title: "#thm articles | Hashnode" description: "Explore 42 articles tagged #thm on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/thm" --- Tag # #thm 42 posts · 2 followers [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 11](https://hashnode.com/posts/tryhackme-the-london-bridge-writeup/6a7aa0e4edd948b2bf3afa5c) ### [TryHackMe : The London Bridge writeup](https://exploitnotes.hashnode.dev/tryhackme-the-london-bridge-writeup?utm_source=hashnode&utm_medium=feed) TryHackMe London Bridge walkthrough covering SSRF, loopback bypass, root HTTP server, SSH key theft, symlink abuse, and Firefox credential recovery. 18 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-the-london-bridge-writeup?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/tryhackme-the-london-bridge-writeup/6a7aa0e4edd948b2bf3afa5c) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 10](https://hashnode.com/posts/tryhackme-dreaming-writeup/6a7a082596af0ef7870afb00) ### [TryHackMe : Dreaming Writeup](https://exploitnotes.hashnode.dev/tryhackme-dreaming-writeup?utm_source=hashnode&utm_medium=feed) TryHackMe Dreaming walkthrough covering Pluck CMS brute force, CVE-2020-29607 RCE, MySQL command injection, and Python library hijacking. 13 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-dreaming-writeup?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/tryhackme-dreaming-writeup/6a7a082596af0ef7870afb00) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 10](https://hashnode.com/posts/tryhackme-whyhackme-writeup/6a79b6bdb6f0f00fce179f0d) ### [TryHackMe : WhyHackMe writeup](https://exploitnotes.hashnode.dev/tryhackme-whyhackme-writeup?utm_source=hashnode&utm_medium=feed) Full Hack The Box WhyHackMe walkthrough covering blind stored XSS, localhost credential theft, SSH, iptables, PCAP analysis, CGI RCE, and root access. 15 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-whyhackme-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 4](https://hashnode.com/posts/tryhackme-towel-on-the-sunbed-writeup/6a71f33420b4883bd91e12d1) ### [TryHackMe : Towel on the Sunbed Writeup](https://exploitnotes.hashnode.dev/tryhackme-towel-on-the-sunbed-writeup?utm_source=hashnode&utm_medium=feed) Complete Towel on the Sunbed THM walkthrough covering race conditions, TOCTOU exploitation, concurrent requests, and vault flag recovery. 6 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-towel-on-the-sunbed-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 4](https://hashnode.com/posts/tryhackme-beach-bar-writeup/6a7166c034de950fe31a3bdb) ### [TryHackMe : Beach Bar Writeup](https://exploitnotes.hashnode.dev/tryhackme-beach-bar-writeup?utm_source=hashnode&utm_medium=feed) Complete Beach Bar THM walkthrough covering Flask YAML deserialization, RCE, privilege escalation, and full root compromise. 7 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-beach-bar-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 4](https://hashnode.com/posts/tryhackme-do-not-disturb-writeup/6a71c7cbbf20ac80073fe1fd) ### [TryHackMe : Do Not Disturb Writeup](https://exploitnotes.hashnode.dev/tryhackme-do-not-disturb-writeup?utm_source=hashnode&utm_medium=feed) Complete Do Not Disturb THM walkthrough covering NoSQL injection, EJS SSTI, Node Inspector abuse, privilege escalation, and root. 8 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-do-not-disturb-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 4](https://hashnode.com/posts/tryhackme-overheard-at-breakfast/6a716d9dba96c430fd96ed91) ### [TryHackMe : Overheard at Breakfast](https://exploitnotes.hashnode.dev/tryhackme-overheard-at-breakfast?utm_source=hashnode&utm_medium=feed) Complete Overheard at Breakfast THM walkthrough covering OSINT, Gravatar profile lookup, email hashing, Base64 decoding, and flag recovery. 5 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-overheard-at-breakfast?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 4](https://hashnode.com/posts/tryhackme-packed-light-writeup/6a7165161ce7b8c122d6bcfa) ### [TryHackMe : Packed Light Writeup](https://exploitnotes.hashnode.dev/tryhackme-packed-light-writeup?utm_source=hashnode&utm_medium=feed) Complete Packed Light THM walkthrough covering PCAP analysis, malware investigation, network forensics, traffic decoding, and flag recovery. 6 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-packed-light-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Jul 22](https://hashnode.com/posts/tryhackme-foolmate-writeup/6a609b9e6fe12e427c94c3e1) ### [TryHackMe : FoolMate Writeup](https://exploitnotes.hashnode.dev/tryhackme-foolmate-writeup?utm_source=hashnode&utm_medium=feed) Learn how FoolMate was solved by bypassing a client-side checkmate gate and exploiting the API move endpoint to capture the flag. 8 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-foolmate-writeup?utm_source=hashnode&utm_medium=feed) [sOn4jit](https://hashnode.com/@son4jit) · [Dec 11, 2025](https://hashnode.com/posts/thm-merry-xssmas-writeup/6a190081782587548359e871) ### [THM Merry XSSmas Writeup: Learning Reflected and Stored XSS Attacks](https://blog.sonajit.in/thm-merry-xssmas-writeup?utm_source=hashnode&utm_medium=feed) This writeup covers TryHackMe Advent of Cyber 2025 Day 11: Merry XSSmas. The objective is to understand reflected XSS, stored XSS, payload injection, and basic web exploitation techniques. 5 min read · [blog.sonajit.in](https://blog.sonajit.in/thm-merry-xssmas-writeup?utm_source=hashnode&utm_medium=feed)