CTF 002 · WEB SECURITY / PURPLE TEAM
FakeBank: Attack & Defend
CompletedA guided TryHackMe investigation connecting web directory enumeration with defensive access control and validation design.
This case is a curated public summary; private source records are not directly accessible to visitors.
Case study
Evidence snapshot
Summarized observations from the documented lab. No private logs or tenant identifiers are included.
| Check | Recorded result | Evidence status |
|---|---|---|
| Web application reconnaissance | Simulated account overview inspected in Firefox | Observed |
| Directory enumeration | Dirb identified additional reachable web paths | Observed |
| Lab completion | Authorized exercise completed; TryHackMe accepted answer | Completed |
| Defensive room | Completion reported by learner; task-by-task evidence not recorded | Reported |
| Security controls | Logging, server-side authorization and validation proposed, not tested | Proposed |
Approach and tools
Inspected the simulated banking application in Firefox, used Dirb for authorized directory enumeration, discovered a staff-oriented deposit interface and completed the prescribed lab action.
Evidence and validation
TryHackMe accepted the offensive lab answer. Defensive Security Intro was completed previously, as reported by the learner; its individual tasks were not captured here.
Result and limitations
Documented the observed lab outcome and proposed defensive logging, server-side authorization and transaction validation controls. No defensive controls were implemented or verified.
Lessons learned
Unlinked web paths are not security boundaries. Authenticate users, authorize every privileged action server-side, and verify denied transactions against reliable audit records and account balances.