• To find hidden URLs, we will use a tool called dirb. This tool uses a brute-force approach, by taking a list of potential page names and testing one by one if they exist in your website. This approach works because people use predictable names a lot of times.

ubuntu@tryhackme:~/Desktop$ dirb http://fakebank.thm

DIRB v2.22 By The Dark Raver

START_TIME: Wed Oct 15 22:07:24 2025

URL_BASE: http://fakebank.thm/

WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

GENERATED WORDS: 4609

Scanning URL: http://fakebank.thm/

+ http://fakebank.thm/bank-deposit (CODE:200|SIZE:4663)

+ http://fakebank.thm/images (CODE:301|SIZE:179)

END_TIME: Wed Oct 15 22:07:31 2025 DOWNLOADED: 4609 - FOUND: 2