Every polite touch on a login or password-reset flow is also a signal an attacker reads. A tour of how helpful auth UX leaks — and why the fix is to be gloriously boring.

Or when I decided to make a blog with an (almost) full new stack and deploy it.

The Network Security capstone as a question sheet: a full-port sweep, flags tucked into service banners, an FTP brute-force, and a stealth scan, answered end to end.

MediaHub hides its logic in the traffic: a leaked backup gives the admin password format, a forged is_verified field skips the OTP, and a decimal-IP curl injection reads the flag off disk.

A forgotten staging box: anonymous FTP leaks the source, an allow-list that resolves to localhost turns the URL previewer into an SSRF, and a tar wildcard in a root backup cron finishes the job.