This multi-room technical walkthrough consolidates Days 9 through 13 of the TryHackMe Advent of Cyber 2025 track: Passwords - A Cracking Christmas, SOC Alert Triaging - Tinsel Triage, XSS - Merry XSSMas, Phishing - Phishmas Greetings, and YARA Rules - YARA mean one!.

Across these five operational scenarios, we analyze offline password cracking mechanics …

Read more

Exploit BOLA/IDOR and UUIDv1 tokens, analyze Windows malware in a sandbox, enumerate hidden TCP/UDP services with Nmap, and hijack ReAct AI agents.

This multi-room technical walkthrough covers Days 4 through 8 of the TryHackMe Advent of Cyber 2025 track: AI in Security - old sAInt nick, IDOR - Santa's Little IDOR, Malware Analysis - Egg-xecutable, Networ…

Read more

This field manual consolidates five TryHackMe web reconnaissance and server exploitation labs into a single offensive workflow: Walking An Application, Content Discovery, Modern Web Stacks, Web Server Attacks - I, and Web Server Attacks - II: Attacking IIS Web Servers. Rather than firing noisy vulnerability scanners blind, you will inspect client-side c…

Read more

This 4-in-1 Mega-Guide consolidates the complete network scanning curriculum of the TryHackMe Junior Penetration Tester path. It covers four interconnected modules: Nmap Live Host Discovery, Nmap Basic Port Scans, Nmap Advanced Port Scans, and Nmap Post Port Scans.

Rather than treating host discovery, port probing, and vulnerability assessment as isolate…

Read more

If you use Firefox Developer Edition, you may have run into an irritating loop: every time you close Firefox or reboot your computer, your Mozilla account is signed out, Firefox Sync is turned off, and an orange warning icon appears on your profile avatar.

Even if you sign back in, the moment Firefox restarts, you are greeted with the same prompt:

Here is what causes this behavior and how to fix it in two minutes.

Why It Happens

In recent Developer Edition builds, Mozilla has been testing a new Rust-based password and credential storage engine.

When enabled, Firefox's credential manager (storage-rust.sys.mjs) can fail during early startup initialization with an internal NS_ERROR_ABORT. Firefox translates this abort into a false Primary password locked error—even if you have never set or enabled a Primary Password.

Because the browser believes its credential storage is locked, it fails to retrieve your stored OAuth sync keys on boot, invalidates the local session, and forces a sign-out.

Step 1: Disable Rust Storage in about:config

Reverting to Firefox's stable, classic credential storage engine resolves the false lock immediately.

1. Open a new tab and navigate to about:config.

2. Click Accept the Risk and Continue.

3. In the search bar, search for:

   signon.storage.rust.active
   

4. Double-click the preference to set its value to false.

(Optional: If signon.storage.rust.enabled also appears in your search results and is set to true, double-click it to set it to false as well.)

Step 2: Remove Zombie Duplicate Sessions

Because Firefox registered a new device profile each time you attempted to sign back in, your Mozilla account likely has multiple stale duplicate sessions.

1. Go to accounts.firefox.com/settings#connected-services.

2. Under Connected Services, look for duplicate entries named Firefox Developer Edition.

3. Click Sign out next to the stale duplicates to clean up your session registry.

Step 3: Sign In and Verify

1. Click the Profile Avatar in the top-right corner of Firefox.

2. Click Sign in to sync and complete your authentication.

3. Once connected, your avatar will return to normal with no warning badges.

4. Completely close Firefox Developer Edition (Ctrl + Shift + Q on Windows/Linux or Cmd + Q on macOS) and reopen it.

Your account will remain signed in, and Firefox Sync will persist across restarts.

This 4-in-1 Mega-Guide synthesizes the core networking foundation of the TryHackMe Junior Penetration Tester path. It covers four interconnected modules: Passive Reconnaissance, Active Reconnaissance, Protocols and Servers, and Protocols and Servers 2.

Rather than treating these as disconnected labs, this blueprint maps out the complete progression from …

Read more

This is my write-up for the TryHackMe room on Report Writing for SOC L2. Written in 2026, I hope this write-up helps others learn and practice cybersecurity.

Task 1: Introduction

Moving into an L2 SOC analyst role means communicating findings outside the internal queue. L1 analysts log ticket notes; L2 analysts write structured incident summaries for lead…

Read more

This is my write-up for the TryHackMe room on SOC L2 Alert Triage. Written in 2026, I hope this write-up helps others learn and practice cybersecurity.

Task 1: Introduction

The SOC Level 2 role centers on investigating escalated alerts and managing active incidents. While L1 analysts focus on initial alert review and SLA metrics, L2 analysts dive deeper i…

Read more

It almost feels easy to blame others for something that you fail at, blame nearby people, or yet, while you have to decide the things you need to do.

You are searching for who must be responsible for your failure, instead of getting focused on being a better person than yesterday. Something that I realize, because the goal is very simple.

You just need to be better than yourself yesterday, do your best today, and then do better tomorrow. I will start trying to do math for a real example.

The example is you are trying to do regular push-ups today, so how many should you do? You just need to do 1 push-up, yes just one push-up. And for tomorrow, let's say you do 2 push-ups; you just need to add 1 each day.

In the gym, maybe we can call this "progressive overload."

So how about in one quarter? You will do approximately 90 push-ups. How about 6 months, and how about 1 year?

365 push-ups

How many total regular push-ups do you do in just one year?

If it happens to be a 366-day leap year, the final total would be 67,161 push-ups.

That is just push-ups; I prefer to choose that because we can do it more easily, even just in the bedroom or another place.

How about other things? Maybe writing? You just need to change the 1 push-up to a word.

I think it will be even more possible that in one year you can create more than 67,161 words originally.

This is my write-up for the TryHackMe room on Complimentary. Written in 2026, I hope this write-up helps others learn and practice cybersecurity.

Task 1: Complimentary

The Byte Lotus Wellness web application (http://complimentary-wellness-app-332173347248.s3-website-us-east-1.amazonaws.com/) delivers a login-free experience that automatically recognizes u…

Read more

This is my write-up for the TryHackMe room on Packed Light. Written in 2026, I hope this write-up helps others learn and practice cybersecurity.

Task 1: Packed Light

The Packed Light room challenges analysts to investigate suspicious network traffic captured from a hotel guest network (traffic.pcapng). The capture shows an infected host regularly beaconin…

Read more

This is my complete walkthrough for the Room 404 room on TryHackMe (Hacker Holidays Day 2). In this challenge, we perform directory enumeration against an unlisted web application hosted on port 8080, locate an exposed .git version control repository, dump the source code, and recover the flag.

Read more

This is my complete walkthrough for The Concierge Knows Too Much room on TryHackMe (Hacker Holidays Day 1). In this challenge, we analyze VERA (Very Efficient Resort Assistant), an AI concierge bot protecting an internal escalation code, and bypass its safety system instructions through prompt injection and persona impersonation.

Read more

Complete walkthrough for the Intro to Cloud Security TryHackMe room. Learn cloud delivery models, security risks, IAM, networking, storage, and policies.

This is my complete walkthrough and write-up for the Intro to Cloud Security room on TryHackMe. In this room, we examine core cloud deployment models, shared responsibility frameworks, data lifecycles, …

Read more

Walkthrough for OWASP API Security Top 10 - Part 1 TryHackMe room. Master BOLA, BUA, excessive data exposure, rate limiting, and function authorization.

This is my complete walkthrough and write-up for the OWASP API Security Top 10 - 1 room on TryHackMe. In Part 1 of this series, we explore the top 5 API security risks, analyzing vulnerable endpoints, ex…

Read more

This is my complete walkthrough and write-up for the Virtualization and Containers room on TryHackMe. In this room, we examine the fundamental concepts of virtualization, hypervisors, Docker containers, and Kubernetes cluster orchestration.

Read more

This is my complete walkthrough and write-up for the Network Security Protocols room on TryHackMe. In this room, we examine primary protocols essential for network security across each layer of the OSI model.

Read more

This write-up covers the Network Device Hardening room on TryHackMe. We will configure secure virtual private networks, build router firewall rules, implement secure administration protocols, and deploy network monitoring tools.

Read more

This is my complete walkthrough and write-up for the Active Directory Hardening room on TryHackMe. In this lab, we will cover key techniques for hardening Active Directory (AD) environments, including secure authentication settings, the Tiered Access Model, Group Policy Objects, and mitigating common AD attacks.

Read more

Earlier this year, while configuring Content Security Policy (CSP) options for my apps, I ran into a cryptic configuration error in the Astro framework. To help other developers, I submitted a pull request directly to the Astro core repository: docs(csp): improve validation messages for directives (withastro/astro#16685) which successfully closes issue #16663.

Here is a full technical walkthrough of the problem, the codebase implementation, and what I learned from contributing to a major open-source project.

The Problem: Cryptic Zod Union Errors

Astro uses the Zod library to define and validate its configuration schema. Zod is excellent for validating structures, but it can struggle with user-friendly messages when checking union types.

In Astro's security configuration, users can define CSP directives in security.csp.directives. However, because of how browser parsers behave, the directives script-src and style-src must be handled separately using dedicated options like security.csp.scriptDirective and security.csp.styleDirective.

If a developer mistakenly placed script-src directly into the general directives array like this:

// astro.config.mjs
export default defineConfig({
  security: {
    csp: {
      directives: ["script-src 'self'"]
    }
  }
});

Astro's validation engine would output a frustratingly vague error:

[config] Astro found issue(s) with your configuration:
! security.csp: Did not match union.

This occurred because the configuration schema evaluated the input against a union of valid directives and fell back to the generic Zod union error, leaving the developer with no indication of what went wrong or how to fix it.

The Solution: Refactoring Zod Schema & Custom Error Maps

To resolve the issue and provide clear, actionable instructions, we had to apply a two-step surgical update to the Astro core package.

Figure 1: The lifecycle flow of a custom configuration validation error traversing the schema and zod-error-map.

1. Refactoring schema validation with superRefine

In packages/astro/src/core/csp/config.ts, the original schema for checking allowed directives was a simple z.custom returning a boolean check:

export const allowedDirectivesSchema = z.custom<CspDirective>((value) => {
  if (typeof value !== 'string') {
    return false;
  }
  return ALLOWED_DIRECTIVES.some((allowedValue) => {
    return value.startsWith(allowedValue);
  });
});

I refactored this validator to use .superRefine. This allowed us to inspect the invalid inputs and attach distinct custom issues depending on the specific error context:

export const allowedDirectivesSchema = z.custom<CspDirective>((v) => typeof v === 'string').superRefine(
  (value, ctx) => {
    const isAllowed = ALLOWED_DIRECTIVES.some((allowedValue) => {
      return value.startsWith(allowedValue);
    });
    if (!isAllowed) {
      if (value.startsWith('script-src') || value.startsWith('style-src')) {
        ctx.addIssue({
          code: z.ZodIssueCode.custom,
          message: `Directives \`script-src\` and \`style-src\` are not allowed in \`security.csp.directives\`. Please use \`security.csp.scriptDirective\` and \`security.csp.styleDirective\` instead.`,
          fatal: true,
        });
      } else {
        ctx.addIssue({
          code: z.ZodIssueCode.custom,
          message: `Invalid directive: "${value}". Allowed directives are: ${ALLOWED_DIRECTIVES.join(', ')}`,
          fatal: true,
        });
      }
    }
  },
);

2. Surfacing custom messages in zod-error-map.ts

Even with superRefine adding the custom issues, Zod's default union error formatter would still swallow the custom messages during validation formatting.

To fix this, we updated Astro's custom Zod error formatter in packages/astro/src/core/errors/zod-error-map.ts. We intercepted custom issue codes containing security.csp and directly pushed the custom messages to the expected error shape array:

if (
  _issue.code === 'custom' &&
  _issue.message &&
  _issue.message.includes('security.csp')
) {
  expectedShape.push(_issue.message);
} else if ('expected' in _issue && typeof _issue.expected === 'string') {
  expectedShape.push(
    relativePath ? `${relativePath}: ${_issue.expected}` : _issue.expected,
  );
}

This bypasses the union-flattening logic, successfully outputting our clean, helpful instructions to the developer's console.

Testing the Validation

To ensure the new error mapping behaves correctly, I added a new unit test in packages/astro/test/units/config/config-validate.test.ts:

it('should provide a helpful error message when script-src or style-src is used in directives', async () => {
  const configError = await validateConfig({
    security: {
      csp: {
        directives: ["script-src 'self'"],
      },
    },
  }).catch((err) => err);

  const formattedError = stripVTControlCharacters(formatConfigErrorMessage(configError));
  assert.equal(
    formattedError,
    `[config] Astro found issue(s) with your configuration:\n\n! security.csp: Did not match union.\n  > Expected type boolean | Directives script-src and style-src are not allowed in security.csp.directives. Please use security.csp.scriptDirective and security.csp.styleDirective instead.\n  > Received { "directives": [ "script-src 'self'" ] }`,
  );
});

The test runs a config validation, formats the message, strips terminal coloring control characters, and asserts that our specific help instruction is rendered perfectly alongside the union error representation.

Contribution Takeaways

Contributing to Astro's core was a fantastic experience. The codebase is clean, well-tested, and uses changesets to automate package version patches. Because this validation error directly affects DX (Developer Experience), it was merged quickly and rolled out in a patch release, resolving configuration confusion for thousands of developers worldwide.

Thanks for reading. See you in the next lab.