TryHackMe: Offensive Security Intro Room Walkthrough

The Offensive Security Intro room is part of TryHackMe's Pre Security learning path, designed to give absolute beginners their first taste of ethical hacking. In this room, you'll hack your first website legally and safely against a simulated banking application called "FakeBank." Let's walk through each task.

Task 1: Think Like a Hacker!

This task sets the foundation by introducing the core mindset behind ethical hacking. It explains the concept of Offensive Security proactively simulating attacker behavior to identify vulnerabilities before malicious hackers can exploit them. This is contrasted with Defensive Security, which focuses on building protections and responding to threats.

Question: Which term describes simulating a hacker's actions to find weaknesses?

Answer: ||Offensive Security||

Task 2: Starting the Lab

This task introduces the virtual desktop environment used throughout the room. A browser automatically launches, displaying the FakeBank application your target for this exercise.

Exploring the dashboard reveals basic account details, including the account holder's name and a bank account number.

Question: What is the bank account number in the FakeBank application?

Answer: ||8881||

Task 3: Find Hidden Pages

Here's where the real hacking begins. The objective is to identify hidden pages on the FakeBank site that aren't linked anywhere in the normal navigation a common security oversight in real world applications.

Tool Introduced: DIRB

Dirb is a command-line web content scanner that brute forces directory and filenames against a wordlist to uncover hidden or unlinked resources on a web server.

Command Used:

dirb http://fakebank.thm

dirb http://fakebank.thm

Running this scan reveals two hidden URLs on the target site lines beginning with a + in the output indicate discovered pages.

Question: What is the other hidden URL (besides /images)?

Answer: ||http://fakebank.thm/bank-transfer||

Task 4: Attack the Admin Page

With the hidden endpoint discovered, it's time to exploit it.

Steps to Complete:

1. Navigate to the /bank-transfer page discovered in Task 3.
2. This exposes a Staff Account / Register Cash Deposits panel sensitive functionality that should be restricted to authorized bank employees only.
3. Enter the account number identified in Task 2.
4. Deposit $2000 (or more).
5. Submit the form and return to the account dashboard.

Result:

Upon success, a celebratory pop-up appears confirming the deposit, with green text displaying a special flag.

Question: Enter the green words as the answer (ALL CAPS).

Answer: ||BANK-HACKED||

Returning to the account page confirms the balance is now positive proving the exploit successfully bypassed intended banking controls.

Remediation Recommendations

For real world applications, developers and security teams should:

• Enforce authentication and authorization on all administrative endpoints
• Never rely on security through obscurity (hiding pages instead of properly securing them)
• Implement role-based access control (RBAC)
• Perform regular penetration testing and directory enumeration scans on their own infrastructure
• Log and monitor access attempts to sensitive endpoints

Final Thoughts

Offensive Security Intro is a perfect starting point for anyone beginning their cybersecurity journey. In just 5 minutes, it demonstrates a real vulnerability class (broken access control via hidden endpoints) using a fun, gamified banking scenario no prior experience required.

Happy hacking!

Powered by Sukshield

Follow me on

LinkedIn: Sumit Battani | Twitter: https://twitter.com/5um1t0x TryHackMe: TryHackMe | 5um1t0x