Offensive Security Intro in hinglish (tryhachme)

Offensive Security ka matlab hai attacker ki tarah sochna aur system/network mein weaknesses (vulnerabilities) dhundhna, taaki real hackers unka misuse karne se pehle unhe fix kiya ja sake.

👉 Example: Penetration tester jaan-bujhkar website ko test karta hai aur dekhta hai ki hacker kis tarah system mein entry kar sakta hai.

Defensive Security iska opposite hai. Isme goal hota hai hackers ko system se door rakhna aur agar attack ho jaye, to uska detection, response aur recovery karna.

👉 Example: Security team firewall, monitoring, EDR/SIEM jaise tools use karke suspicious activity detect karti hai aur attack hone par action leti hai.

🏦 Bank wala example

Paragraph keh raha hai ki ek hi bank mein do log kaam karte hain, lekin dono ka role alag hai:

• 👨‍💻 Person 1 — Offensive Security: Attacker ki tarah sochkar bank ke systems mein vulnerabilities find karega.
• 🛡️ Person 2 — Defensive Security: Bank ke systems ko attacks se protect karega aur attack hone par response karega.

FakeBank website mein weakness find karna

Ab hum FakeBank website mein ek weakness find karenge.

Hackers jab kisi website ko check karte hain, to ek common cheez jo woh search karte hain woh hoti hai aisi pages jo website par directly linked nahi hote.

Inhe hum hidden/unlinked pages keh sakte hain.

🤔 Hackers hidden pages kyun dhoondhte hain?

Kyuki kabhi-kabhi ye hidden pages humein:

• 🔐 Sensitive pages
• 📄 Important information
• 👤 Admin/login pages
• ⚙️ Aise features

tak le ja sakte hain, jinhe organisation ne publicly dikhane ka intention nahi rakha hota.

🛠️ DIRB kya hai?

In hidden/unlinked pages ko find karne ke liye cybersecurity tools use kiye ja sakte hain.

Ek aisa tool hai dirb.

dirb terminal se run kiya jaata hai aur ye common words/paths jaise:

• login
• admin
• backup
• config

etc. ko check karke website par existing directories/pages find karne ki koshish karta hai.

💻 Terminal kya hai?

Terminal ek interface hai jiske through hum computer ke saath commands ke zariye interact karte hain aur cybersecurity tools run kar sakte hain.

Example:

dirb http://example.com

Yahan:

• dirb → tool ka naam
• http://example.com → jis website ko test karna hai uska URL

🎯 TryHackMe task mein kya karna hai?

Tumhe FakeBank website:

http://fakebank.thm

ko dirb se scan karna hai aur jo hidden/unlinked page milega, us information ko use karke question ka answer dena hai.

Simple flow:

Website → DIRB → Hidden pages find → Interesting page identify → Question ka answer

Hidden Admin Panel

Ab tumhe website par ek hidden admin panel mil gaya hoga. Is panel ki help se account mein money add ki ja sakti hai.

Website ke top mein jo search/address bar hai, usmein discovered page ko manually add karke access karna hai:

/bank-transfer

Yaani agar website hai:

http://fakebank.thm

to page hoga:

http://fakebank.thm/bank-transfer

⚠️ Important concept

Is task ka main security lesson ye hai:

Koi page hidden hone ka matlab ye nahi hai ki woh secure hai.

Agar website ne kisi page ka link hide kar diya, lekin page ko properly protect nahi kiya, to koi bhi person direct URL enter karke us page ko access kar sakta hai.

💰 Ab task mein kya karna hai?

Hidden admin panel mein:

1. Account number 8881 select karo.
2. Ye account number Task 2 mein verify kiya gaya tha.
3. Account mein at least 2,000 deposit karo.
4. Check karo ki account ka balance positive ho gaya hai.

🧠 Security lesson

Ye security through obscurity ka example hai:

Page ko hide karna ≠ Page ko secure karna

Proper security ke liye admin panel par authentication + authorization/access control bhi hona chahiye.