Red Team vs Blue Team: My Hands-on Experience with TryHackMe

When entering cybersecurity, the terms Offensive (Red team) and Defensive (Blue Team) get thrown around a lot. Today, I completed both the Offensive Security Intro and Defensive Security Intro rooms on TryHackMe to see how both sides work in real scenarios.

Here is the quick breakdown of what I learned from both labs!

Part 1: Offensive Security (thinking Like an Attacker)

Offensive security is about finding system vulnerabilities before malicious hackers do

What I Did in Lab:

1. Directory Enumeration: Used the command-line tool dirb to scan a target bank site (fakebank.thm)for hidden directories:

dirb http://fakebank.thm

dirb http://fakebank.thm

2. Exploitation: Located an hidden page /bank-transfer and successfully transfer funds directly to account 8881.

Lesson Learned: If admin/transaction routes lack proper authentication, anyone can locate and misuse them. Finding these flaws helps developers patch them!

part2: Defensive Security (Protecting & Monitoring)

Defensive Security focuses on active monitoring, detecting threats, and responding to incidents quickly to keep system secure.

What I Did in the Lab:

1. SOC Monitoring: Analyzed a security Analyst Dashboard to track live security events.
2. Identifying Suspicious Activity: Detected an automated URL Discovery / Directory Enumeration attack originating from source IP: 32.122.195.63 .
3. Log Analysis: Investigated the security logs showing unauthorized GET requests (like 404 attempts on https://fakebank.com/admin

Lesson Learned: SOC Analysts use event logs to detect directory enumeration attacks early and block suspicious IPs before a full breach happens.

Quick comparison: Red vs Blue

Offensive Security (Red Team)

• Main goal: Find vulnerabilities & simulate attacks
• Key Action: Ethical hacking/ Path Discovery
• My Experience: Used drib to find hidden page.

Defensive Security (Blue Team)

• Main goal: Protect system & respond to incidents.
• Key Action: Monitoring logs / threat detection
• My Experience: Analyzed SOC dashboard for suspicious IPs

Conclusion

Exploring both sides gave me a complete picture of the cybersecurity ecosystem: You can't build a strong defense without understanding how attacks happen.

Next up: Deep diving into computer & Network Fundamentals!

"Every system has a story. I'm learning how to read it." — DragonFly