From a Single IP to Exfiltrated Passwords in a PNG: My First Freelance Pentest Engagement

Disclaimer: This article describes a security research activity carried out in a controlled context , with educational goals and the aim of improving security. All references to IPs, domains, paths, file names, and configurations have been anonymized or modified to prevent any form of harm or unauthorized enablement. Nothing below is an invitation to test systems without a written mandate from the owner or legal responsible party. A real, anonymized case: from PoC to local file reading, ending w