From Zero To First Hack: A Beginner’s Guide To Offensive Security With TryHackMe + Video

Introduction:

Offensive security represents a fundamental shift in how we approach cybersecurity—instead of merely defending against attacks, it involves proactively simulating an attacker’s mindset to identify and fix vulnerabilities before malicious actors can exploit them. TryHackMe’s “Offensive Security Intro” room offers absolute beginners a safe, legal environment to perform their first website hack, demonstrating that with the right guidance, anyone can understand the ethical hacker’s methodology.

Learning Objectives & Secrets:

Objective 1: Understand the Offensive vs. Defensive Security Mindset – Learn the core distinction between protecting systems (defensive) and proactively attacking them to find weaknesses (offensive). The secret? You cannot effectively defend what you don’t understand how to attack.
Objective 2 Secret Tip: Master Directory Enumeration with Gobuster – The most common entry point for attackers is finding hidden directories and files that developers left exposed. Gobuster is the tool of choice—it brute-forces URLs using wordlists to discover unlinked pages. The secret tip: always run directory enumeration with a comprehensive wordlist; the default lists often miss critical paths.
Objective 3 Secret Tip: Identify Broken Access Control (OWASP 1) – The FakeBank lab reveals a classic vulnerability: an unauthenticated admin panel that allows money transfers without any login. The secret tip: when testing applications, always check whether sensitive functionality is properly authenticated—this single check catches countless critical flaws.

You Should Know:

1. Setting Up Your Offensive Security Lab Environment

TryHackMe provides browser-based virtual machines, eliminating the need for local setup. To begin:

Navigate to tryhackme.com and create a free account.
Access the “Pre-Security” learning path and select the “Offensive Security Intro” room.
Click the “Start Machine” button to launch the target virtual machine running the FakeBank website.
Open the AttackBox or use the in-browser terminal for your attacking machine.

2. Directory Enumeration with Gobuster – Step-by-Step

Directory enumeration is the process of discovering hidden pages and directories on a web server. Here’s how to perform it:

Linux/macOS Commands:

 Basic Gobuster directory enumeration
gobuster dir -u http://fakebank.thm -w /usr/share/wordlists/dirb/common.txt

With additional options for better results
gobuster dir -u http://fakebank.thm -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50 -x php,html,txt

If wordlist is in current directory
gobuster dir -u http://fakebank.thm -w wordlist.txt

Command Breakdown:

– `dir` – Specifies directory/file enumeration mode
– `-u` – Target URL to scan
– `-w` – Wordlist file containing potential directory names
– `-t` – Number of concurrent threads (faster scans)
– `-x` – File extensions to append (e.g., .php, .html)

Windows (using PowerShell with Gobuster):

 Download Gobuster for Windows or use WSL
gobuster.exe dir -u http://fakebank.thm -w C:\wordlists\common.txt

Using WSL Ubuntu terminal
wsl gobuster dir -u http://fakebank.thm -w /usr/share/wordlists/dirb/common.txt

What This Does: Gobuster sends HTTP requests for each word in the wordlist, appending them to the base URL. When it receives a `200 OK` status, it reports the discovered path. In the FakeBank lab, this reveals /bank-transfer—an unlinked admin page.

3. Exploiting the Vulnerability – The Bank Transfer

Once you discover the hidden `/bank-transfer` page:

Navigate to `http://fakebank.thm/bank-transfer` in your browser.
You’ll find a form allowing money transfers with no authentication required.
Transfer $2,000 from account `2276` to your account 8881.
Return to your account dashboard and refresh to see the updated balance.
The flag `BANK_HACKED` (or BANK-HACKED) confirms successful exploitation.
Understanding the Vulnerability Class – Broken Access Control

This lab demonstrates Broken Access Control (OWASP Top 10 1). The vulnerability occurs when:

Administrative functionality is exposed without authentication checks
Sensitive operations (money transfers, data modification) lack proper authorization
Hidden paths provide security through obscurity—which is not security at all

Mitigation Strategies:

Implement authentication for all administrative functions
Use role-based access control (RBAC)
Never rely on unlinked URLs for security
Conduct regular penetration testing to identify exposed endpoints

5. Real-World Penetration Testing Workflow

The Offensive Security Intro room models a simplified penetration testing methodology:

| Phase | Activity | Tool/Method |

|-|-|-|

6. Advanced Directory Enumeration Techniques

For more comprehensive testing, consider these additional approaches:

Using ffuf (Faster Fuzzing Tool):

 Directory fuzzing with ffuf
ffuf -u http://fakebank.thm/FUZZ -w /usr/share/wordlists/dirb/common.txt

With file extensions
ffuf -u http://fakebank.thm/FUZZ -w /usr/share/wordlists/dirb/common.txt -e .php,.html,.txt

Using Dirb (Built-in Kali Tool):

 Simple directory brute-force
dirb http://fakebank.thm /usr/share/wordlists/dirb/common.txt

7. Building Your Cybersecurity Learning Path

TryHackMe offers structured learning pathways:

Pre-Security – Foundational concepts (this room is Step 1)
Intro to Defensive Security – Understanding the blue team perspective
Web Fundamentals – Deep dive into web application security
Junior Penetration Tester – Comprehensive offensive security training

What Undercode Say:

Key Takeaway 1: Hands-on learning trumps theory every time. Reading about hacking is fundamentally different from actually doing it. TryHackMe’s guided approach proves that with clear instructions, even someone with zero IT background can successfully perform their first ethical hack. The methodical, curious mindset—not technical prowess—is the true foundation of offensive security.
Key Takeaway 2: Simple tools reveal critical vulnerabilities. Gobuster, a straightforward directory brute-forcing tool, exposed a broken access control vulnerability that would have severe real-world consequences. This reinforces that security flaws often aren’t sophisticated—they’re just hidden in plain sight. The most important skill is knowing where to look and maintaining relentless curiosity.

Prediction:

+1 The democratization of cybersecurity education through platforms like TryHackMe will continue to lower barriers to entry, creating a more diverse and capable security workforce over the next 3–5 years.
+1 Hands-on, gamified learning will increasingly replace traditional certification-heavy approaches as employers recognize that practical skills matter more than theoretical knowledge.
-1 As more beginners enter the field through accessible platforms, the industry may see a temporary increase in poorly executed “ethical hacks” from those who misunderstand the legal and ethical boundaries of their new skills.
+1 The rise of AI-powered security tools will complement, not replace, the foundational skills learned in rooms like this—making human curiosity and methodical thinking more valuable than ever.
-1 Organizations that fail to implement basic security controls like proper authentication will remain vulnerable to the exact type of attack demonstrated in this 15-minute beginner lab.

▶️ Related Video (82% Match):

https://www.youtube.com/watch?v=2-As-Vhr_dM

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: https://lnkd.in/p/eAHwyWpC – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Listen to this Post