root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to TryHackMe writeups
root@sparrow:~/writeups$ cat offensive-security-intro.md
// Fundamentals

Offensive Security Intro

20 Nov 2025 · 5 min read
FundamentalswriteupstryhackmeEasy
An introductory offensive security room: you simulate an attacker's behavior to find vulnerabilities before a real cybercriminal does. The hands-on exercise has you hack a simulated banking application, FakeBank, by discovering a hidden directory with Gobuster and abusing an unprotected admin portal to perform an unauthorized money transfer.
PlatformTryHackMe
CategoryFundamentals
DifficultyEasy
RoomIntro to Offensive Security

Task 1 — What is Offensive Security?

Offensive security is about breaking into systems, exploiting bugs, and finding insecure configurations — in short, simulating an attacker's actions to uncover vulnerabilities before a real criminal does. Its counterpart, defensive security, focuses on preventing and detecting those intrusions. The core of the offensive mindset is thinking like a hacker, but ethically and in a legal, controlled environment.

Q: Which option better represents the process of simulating an attacker's actions to find vulnerabilities in a system?
A: Offensive Security

Task 2 — Hacking Your First Machine

In this task you attack FakeBank, a simulated banking web application. The goal is to locate a hidden page that isn't linked from the site and use it to transfer money without authorization. The flow is as follows.

1. Start the machine and open the terminal

Launch the room's VM. The interface shows the browser with the application and a terminal in the right pane; click the terminal icon to start typing commands.

2. Discover hidden directories with Gobuster

Gobuster is a directory brute-forcing tool written in Go: it tries a list of names (a wordlist) against the web server and reports the paths that exist based on their HTTP status code. This surfaces pages that aren't publicly linked — a technique also known as content/directory discovery, and the same idea behind tools like ffuf, dirb, or feroxbuster.

gobuster -u http://fakebank.thm -w wordlist.txt dir
  • -u sets the target URL (http://fakebank.thm).
  • -w sets the wordlist (wordlist.txt).
  • dir selects directory brute-forcing mode.

Example output:

/images (Status: 301)
/bank-transfer (Status: 200)

The interesting path is /bank-transfer, which returns 200 OK: a hidden admin portal.

3. Access the hidden portal and exploit the vulnerability

In the browser, navigate to the discovered page:

http://fakebank.thm/bank-transfer

This is an admin panel that lets you move money with no access control whatsoever. Using that interface, transfer $2000 from account 2276 to account 8881 and submit the form. A "Success, transfer complete" message appears. Returning to your account view, the updated balance reveals the room's flag.

This is a textbook case of two overlapping weaknesses. First, security through obscurity: the page isn't linked anywhere, but "not linked" is not "protected" — anyone who finds or guesses the URL can reach it. Second, and more seriously, broken access control (OWASP Top 10 category A01:2021): the endpoint performs a sensitive, state-changing action (moving money between accounts) without checking that the caller is an authenticated, authorized administrator. Real fixes need both: don't rely on hiding the URL, and enforce authentication/authorization on every endpoint that can change data.

Flag: BANK-HACKED

4. Terminate the machine

When you're done, click the red Terminate button in the TryHackMe interface to stop the VM.

Task 3 — Careers in Cyber Security

The room closes by introducing a few offensive-side roles. No answers are required; just read through it:

  • Penetration Tester: finds and exploits security vulnerabilities.
  • Red Teamer: simulates real-world attacks to test an organization's defenses.
  • Security Engineer: designs and maintains the systems and controls that prevent cyberattacks.

Concept Recap

TaskFocus areaKey takeaway
1Offensive security conceptEthical simulation of an attacker's actions
2FakeBank exerciseGobuster → hidden /bank-transfer → BANK-HACKED
3CareersPenetration Tester, Red Teamer, Security Engineer

Key Takeaways

  • Offensive security simulates an attacker's behavior to uncover vulnerabilities ethically and legally.
  • Gobuster (dir mode) discovers hidden directories and pages that aren't linked on the site.
  • An exposed admin portal with no access control enables critical actions such as unauthorized money transfers — a real-world instance of OWASP's Broken Access Control (A01:2021).
  • "Hidden" is not "secured": security through obscurity fails as soon as the URL is discovered, guessed, or leaked.
  • Understanding why each step is performed matters as much as knowing the command.