Writeups for TryHackMe's Hacker Holidays 2026, a free 14-day hacking event set in The Byte Lotus — a five-star resort with a zero-star security posture.
Starting July 27, 2026, a new room (challenge) unlocks daily at 4PM UTC, covering topics like OSINT, web exploitation, cloud security, digital forensics, and AI prompt attacks — difficulty ramping from beginner to advanced. Along the way, players interact with a cast of shady hotel guests, a paranoid IT admin convinced the whole resort is compromised, and VERA, an AI concierge that remembers everything about everyone.
This repo contains my notes and solutions for each daily challenge as I work through the event.
Each day's challenge has its own folder with a writeup template:
day-00/README.md
day-01/README.md
day-02/README.md
...
day-14/README.md
| Day | Challenge Name | Topic | Status |
|---|---|---|---|
| 00 | The Brochure | OSINT | 🟩 |
| 01 | The Concierge Knows Too Much | AI / Prompt Injection | 🟩 |
| 02 | Room 404 | Web / Directory Enumeration | 🟩 |
| 03 | Complimentary | Cognito / IAM | 🟩 |
| 04 | Packed Light | Network Forensics / PCAP | 🟩 |
| 05 | Beach Bar | Boot2root / Pentesting | 🟩 |
| 06 | Overheard at Breakfast | OSINT | 🟩 |
| 07 | Do Not Disturb | Boot2root / Pentesting | 🟩 |
| 08 | Towel on the Sunbed | Web Exploitation / BurpSuite | 🟩 |
| 09 | CryptoCabana | Cloud / Azure CLI | 🟩 |
| 10 | The Hollow Shell | Web / Zip Slip | 🟩 |
| 11 | Infinity Pool | Boot2root | 🟩 |
| 12 | After Hours | Forensics | 🟩 |
| 13 | The Guestbook | AI / Prompt Injection | 🟩 |
| 14 | Management Wants a Word | Forensics | 🟩 |
These writeups are for educational purposes and reflect my personal approach to solving each room. Spoilers ahead if you haven't completed the challenges yourself!