Hack Your First Website on TryHackMe

Hack a fake bank and master the Linux terminal on TryHackMe.

Introduction

30 Second Summary

Every website you visit has pages you never see. Some are hidden admin panels, forgotten test pages, or internal tools that developers accidentally left exposed. Attackers know this, and they use simple tools to find those pages before anyone else does.

In this project, you will hack into a fake banking application by discovering its hidden pages and exploiting a vulnerable admin panel. You will also learn the Linux terminal that professional hackers use as their primary tool.

What You'll Build

You will complete two guided hacking rooms on TryHackMe, a free platform where you can legally practise offensive security skills in a safe environment.

By the end of this project, you'll have:

A completed "Offensive Security Intro" room where you hacked a fake bank by discovering hidden web pages and exploiting an admin panel.
A completed "Linux Fundamentals Part 1" room where you learned essential terminal commands every hacker uses daily.
A TryHackMe profile tracking your progress, ready for your next cybersecurity challenge.
Secret Mission: Perform your first network reconnaissance scan using Nmap to discover what services are running on a target machine.

Are there any prerequisites?

None. All you need is a web browser and an internet connection. This guide walks you through creating your free TryHackMe account and everything else happens inside your browser.

Set Up Your TryHackMe Account

Every hacker needs a training ground. TryHackMe is a platform that gives you safe, legal environments to practice real hacking techniques without breaking any laws.

In this step, you will create your free TryHackMe account and navigate to the first room you will hack. Think of a "room" as a guided challenge with a specific objective.

In this step, get ready to:

Create a free TryHackMe account.
Navigate to the Offensive Security Intro room.

Create your free account

Open your web browser and go to tryhackme.com.
Click Get Started or Sign Up on the homepage.
Sign up using your email, Google, or LinkedIn account.
Follow the on-screen prompts to complete your registration.

What is TryHackMe?

TryHackMe is a free online platform where you learn cybersecurity through hands-on challenges called "rooms." Each room teaches a specific skill by giving you a real machine to hack in your browser.

The free tier gives you access to hundreds of rooms and 1 hour of daily AttackBox time. The AttackBox is a browser-based hacking machine you will use later in this project. No credit card is required.

After completing the signup, you should land on your TryHackMe dashboard. This is your home base for finding rooms and tracking your progress.

Not seeing your dashboard?

If the page does not load, try refreshing your browser. If you are stuck on a verification step, check your email inbox (and spam folder) for a confirmation link from TryHackMe.

help me troubleshoot my TryHackMe signup

Navigate to your first room

Now that your account is ready, you will find the room where you will hack a fake bank.

Click the search bar at the top of the TryHackMe page.
Type Offensive Security Intro and press Enter.
Click on the room titled Offensive Security Intro in the search results.

What is the Offensive Security Intro room?

This room is tagged as Easy and takes about 5 minutes. Its description says: "Hack your first website (legally in a safe environment) and experience an ethical hacker's job."

It has been completed by over 129,000 users, so you are in good company.

You should now see the room page with Task 1 visible. Do not start the lab yet. You will do that in the next step.

Your account is set up and you are looking at your first target. Next up, you will launch the lab and hack a fake bank.

Hack a Fake Bank

Your TryHackMe account is set up and you are on the Offensive Security Intro room page. Now it is time to think like an attacker.

In this step, you will break into a fake banking application by discovering hidden web pages that the developers never intended you to find. Then you will exploit a vulnerable admin panel to transfer money into your account.

In this step, get ready to:

Start the virtual lab and explore the FakeBank application.
Discover hidden pages using a brute-forcing tool.
Exploit the admin panel to transfer funds into your account.

Start the lab and explore the target

The Offensive Security Intro room uses a virtual desktop that simulates a real system. You will interact with a fake banking app called FakeBank inside this virtual environment.

Scroll down to Task 2 ("Starting the Lab").
Click the View Site button to start the virtual desktop.
Wait for the virtual desktop to load. A browser will automatically open inside it, displaying the FakeBank application.
Look at the FakeBank page and find the bank account number displayed on the screen.
Enter the bank account number as your answer to the Task 2 question.

What is a virtual desktop?

A virtual desktop is a computer running inside your browser. It has its own desktop, browser, and terminal. Everything you do inside it stays in the lab environment, so you can hack safely without affecting your real machine.

Virtual desktop not loading?

Give it 30-60 seconds to fully boot up. If the browser inside the virtual desktop does not open automatically, look for a browser icon on the desktop and double-click it.

If you see a blank screen for more than 2 minutes, try refreshing your TryHackMe page and clicking View Site again.

Help me get my virtual desktop working on TryHackMe.

Discover hidden pages with dirb

Web applications sometimes have hidden pages that developers left accessible by mistake. Attackers use tools to discover these pages by trying thousands of common page names automatically.

Scroll down to Task 3 ("Find Hidden Pages").
Inside the virtual desktop, look for the terminal icon and click it to open a terminal.
Run your first hacking command by typing the following into the terminal:

dirb http://fakebank.thm

What does this command do?

The dirb tool performs brute-forcing against a web server. It tries thousands of common directory and page names (like /admin, /login, /backup) to find ones that exist but are not linked anywhere on the site.

In the output, any line starting with + is a discovered page. The tool will find two URLs.

Wait for the scan to complete. It may take a minute or two.
Look at the results. One discovered URL is http://fakebank.thm/images. Identify the second URL in the output.
Enter the second hidden URL as your answer to the Task 3 question.

Dirb scan not working?

Make sure you typed the command exactly as shown, including http:// at the start. A typo in the URL will cause the scan to fail immediately.

If the terminal is not responding, try clicking inside the terminal window first to make sure it is focused.

Help me troubleshoot my dirb scan in TryHackMe.

Exploit the admin panel

You have just discovered a hidden admin panel that the FakeBank developers never intended customers to access. This is the vulnerability you will exploit to transfer money.

Scroll down to Task 4 ("Attack the Admin Page").
In the browser inside the virtual desktop, add /bank-transfer to the end of the FakeBank URL.
Press Enter to navigate to the hidden admin transfer page.
Enter account number 8881 in the account field.
Enter 2000 or more in the amount field.
Submit the transfer.
Return to your FakeBank account page and confirm the balance is now positive.

A green pop-up message will appear on screen. Enter those green words (in ALL CAPS) as your answer to the Task 4 question.

Why does this work?

The developers built an admin page for internal use but forgot to restrict access. Anyone who knows the URL can reach it. This is a common real-world vulnerability called an insecure direct object reference.

In a real penetration test, discovering and exploiting misconfigurations like this is exactly how ethical hackers help companies fix their security before attackers find them.

No green pop-up appearing?

Make sure you deposited $2000 or more, not less. The pop-up only triggers when the account balance turns positive.

Double-check that you used account number 8881. Using the wrong account number means the money goes to someone else.

Help me complete the FakeBank admin panel exploit.

You just hacked your first website. You discovered hidden pages, exploited a vulnerable admin panel, and transferred money into your own account. Next up, you will master the Linux terminal that professional hackers use as their primary tool.

Master the Hacker's Terminal

You just hacked a bank. You discovered hidden pages with dirb and exploited a vulnerable admin panel to steal money. Every one of those commands was typed into a Linux terminal.

Linux is the operating system that powers most of the internet's servers, smart devices, and hacking tools. If the last step was about thinking like a hacker, this step is about moving like one. You will learn to navigate the file system, search for hidden data, and redirect output.

In this step, get ready to:

Open the "Linux Fundamentals Part 1" room on TryHackMe.
Practice essential navigation and file commands in an interactive terminal.
Search for hidden files using find and grep.

Open the Linux Fundamentals room

The Linux terminal is where hackers spend most of their time. TryHackMe has an interactive room that gives you a real Linux machine right in your browser to practice on.

In the search bar at the top of TryHackMe, type Linux Fundamentals Part 1 and press Enter.
Click on the room titled Linux Fundamentals Part 1.
Read through Task 1 (Introduction) to understand why Linux powers most servers, smart devices, and hacking tools.
Scroll down to Task 3 ("Interacting With Your First Linux Machine").
Click the green button to start your interactive Linux machine in the browser.
Wait for the machine to boot. You will see an IP address and an expiry timer appear at the top of the screen.

What is the in-browser machine?

TryHackMe gives you a real Linux terminal running in the cloud, displayed directly in your browser tab. You do not need to install anything on your own computer.

This is a "task machine" that is separate from the AttackBox. It does not count against your 1-hour daily AttackBox limit.

You should see a terminal interface ready for commands.

Run your first commands

Every hacker needs a handful of core commands to move around a Linux system. You will start with two commands that print information, then graduate to navigating folders and reading files.

Scroll to Task 4 ("Running Your First few Commands").
In your Linux terminal, practice these two commands:

echo hello
whoami

What do these commands do?

echo hello outputs whatever text you type after it. Think of it as the terminal's way of "saying" something back to you.
whoami shows your current username on the system. This tells you which account you are logged in as.

Answer the questions in Task 4 using what the terminal shows you.
Scroll to Task 5 ("Interacting With the Filesystem!").
Practice these navigation commands in your terminal:

ls
cd foldername
cat filename
pwd

What do these commands do?

ls lists all files and folders in your current directory.
cd foldername changes into a directory. Replace foldername with the actual folder name you want to enter.
cat filename displays the contents of a file. Replace filename with the file you want to read.
pwd prints your current location in the file system. This is your "you are here" marker.

Answer the questions in Task 5 by exploring the file system with these commands.

Use commands together

Try running ls first to see what folders exist, then cd into one, then ls again to see what is inside. Chaining these commands together is how you explore a system.

Hunt for hidden files

Hackers rarely know exactly where sensitive data lives on a system. The find and grep commands let you search an entire machine for files and text patterns.

Scroll to Task 6 ("Searching for Files").
Practice locating files by name:

find -name passwords.txt
find -name *.txt

What do these commands do?

find -name passwords.txt searches for a file with that exact name, starting from your current directory.
find -name *.txt uses a wildcard (*) to find all files ending in .txt. This is how you discover files when you only know the extension.

Practice searching inside files for specific text:

grep "search_term" filename

What does grep do?

grep searches inside a file for lines containing your search term. Replace search_term with the text you are looking for, and filename with the file to search.

Imagine you have access to a server with thousands of configuration files. grep lets you find the one line that contains a password or API key without reading every file manually.

Answer the questions in Task 6 using the commands above.
Scroll to Task 7 ("An Introduction to Shell Operators").
Learn how shell operators redirect output:

echo hello > output.txt
echo world >> output.txt

What do these operators do?

> redirects output to a file, overwriting anything that was there before.
>> appends output to the end of a file without erasing existing content.

Hackers use these operators to save scan results, build wordlists, and log data during an engagement.

Answer all remaining questions in Task 7.
Continue through Task 8 and Task 9 to complete the room.

Your room progress should now show 100% completion. You can navigate Linux like a hacker.

Room not showing 100%?

Scroll through each task and check for unanswered questions. TryHackMe highlights incomplete questions in red. Make sure you have clicked Submit after typing each answer.

If your machine expired, click the green button again to restart it and continue where you left off.

Having trouble with a specific answer? Help me figure out the answer to a TryHackMe Linux Fundamentals question

Secret mission

Reconnaissance with Nmap

Every real-world hack starts with reconnaissance. Before attackers exploit anything, they scan the target to discover what doors are open. In this secret mission, you will use Nmap to perform your first network scan and discover running services on a target machine.

Clean Up Your Resources

This project runs entirely in your browser on TryHackMe's free tier, so there are no ongoing costs or local files to worry about. Decide whether to keep your running machines active, let them expire on their own, or terminate them now.

Resources you used:

TryHackMe free account (stores your progress and completed rooms).
AttackBox session (browser-based Kali Linux machine, expires after 1 hour for free users).
Target lab machine (deployed inside the Nmap/Network Security room, expires automatically).

Keep everything running

No action needed. Choose this if you plan to continue exploring more TryHackMe rooms right away.

Your AttackBox session will remain active until the 1-hour free tier limit runs out.
Your target lab machine will stay running until its expiry timer counts down.
Your TryHackMe account keeps all your progress, badges, and completed rooms permanently.

Pause - I'll come back to this later

Shut down your running machines to free up your daily AttackBox time. Your account and progress are saved permanently.

In the Nmap/Network Security room, click the machine info card at the top of the page and select the terminate option to stop the target lab machine.
Your AttackBox will expire on its own after the 1-hour session ends. You can also close the browser tab to end the session early.
Your TryHackMe account, completed rooms, and progress are saved automatically. Come back any time and pick up where you left off.

Delete - I don't want to use this again

Remove all active sessions. Your TryHackMe account is free and stores your progress, so there is no financial reason to delete it.

In the Nmap/Network Security room, click the machine info card at the top of the page and select the terminate option to stop the target lab machine.
Close the AttackBox browser tab to end the session immediately.
Your TryHackMe account is free with no billing attached. If you want to keep it for future use, no action is needed. There are no ongoing charges.

Why keep your TryHackMe account?

Your completed rooms, streaks, and badges are tied to your account. TryHackMe is free and does not charge you for having an account. If you ever want to continue learning cybersecurity, your progress will be waiting for you.

Nice Work!

You just hacked your first website and learned the Linux terminal. These are the two foundational skills that every ethical hacker builds on throughout their career.

You've learned how to:

Hack a fake bank by discovering hidden web pages with dirb and exploiting a vulnerable admin panel to transfer funds.
Master essential Linux commands including ls, cd, cat, pwd, find, grep, and shell operators.
Apply the hacker methodology of reconnaissance, discovery, and exploitation against a real target.
Secret Mission: Performed network reconnaissance with Nmap to discover open ports and running services on a target machine.

Ready to quiz yourself?