I always had this curiosity to explore the systems behind the services I used. Not in a destructive way - more like wanting to understand how things actually worked. Because of that curiosity, I often found myself going deeper than most people ever bothered to.
Growing up, this habit followed me everywhere.
During my school days, I spent a lot of time in the computer lab. One day, out of curiosity, I realized how casually credentials were being handled on shared machines. That little discovery opened a door. I used what I found to explore our school’s internal systems.
Nothing serious - mostly poking around, understanding structures, permissions, and how everything connected. I did have some harmless fun though. Once, I changed a friend’s name in a backend system. Later, when he went to pay his tuition fee and saw the altered name on the receipt, the confusion on his face was priceless xD.
It wasn’t about breaking things. It was about curiosity, learning, and a bit of teenage mischief. Those were genuinely golden school days.
Then 2022 came. Board exams. A stressful time for everyone.
After the exams were over, curiosity kicked in again. I wondered how the results infrastructure worked - how data moved, how systems were connected, how information was protected. While exploring publicly reachable components, I stumbled across a misconfiguration that exposed more than it should have.
I ended up seeing my results before they were officially published.
I didn’t tell anyone. I didn’t change anything. I just closed everything and moved on. But in my head, that moment stuck.
I consider that the real beginning.
Later that year, I got admitted to North South University.
This was a proper, professional environment. Big organization. Real systems. Real users. Real pressure.
One of the first things every student struggles with there is the online course registration system. Limited slots, thousands of students, everyone clicking refresh at the same second. It was frustrating af.
So I did what I always do - I tried to understand how the system worked.
I observed traffic patterns, timing behavior, and response logic. Eventually, I automated my own registration flow so I wouldn’t have to fight the chaos manually. It worked. I got my courses without the stress.
But curiosity never really stops at “it works”.
While continuing to observe the system, I noticed certain components interacting with external services. One day, completely unrelated, a friend’s payment failed. We went to the financial office to get it sorted out.
While they were working, I noticed something on their screen - an internal-looking URL tied to their payment process. It felt old. Untouched. The kind of thing that’s been running quietly for years because “it still works”.
Later, I tested whether anything similar was reachable from the outside.
To my surprise, a non-production component was exposed.
It wasn’t meant to be public. It wasn’t actively monitored either. From there, things escalated faster than I expected.
What I found wasn’t flashy - just a chain of small oversights. Old configurations. Trust assumptions. Systems that were never designed to face the internet directly.
Over time, access led to more access.
I spent weeks carefully understanding what I was seeing - reading code, mapping internal services, learning how different parts of the infrastructure talked to each other. I didn’t rush. I didn’t break things. I just observed.
Eventually, I realized the scope of what I had access to.
That’s when it stopped being fun.
This wasn’t a lab. This wasn’t a game. This was a real organization, with real data, real money, and real consequences.
So I contacted my research advisor and explained everything at a high level. He advised me to report it to the IT department. I tried. Multiple times.
I was ignored.
After that, I reached out to my mentor - the dean of our department. He understood immediately. Within days, I was connected to the right people.
Things moved fast after that.
Instead of trouble, I was offered an opportunity.
A job.
Something I genuinely never expected.
Looking back, it still feels unreal. What started as childhood curiosity, harmless exploration, and a desire to understand systems somehow turned into a professional path.
My curiosity paid off.
During my time working there, I had some truly unforgettable experiences - both technical and human. I’ll probably write about those someday.
For now, this is just an old story.
(Btw Before calling this an AI slop I would like to clarify that I’m not that good in writing so used GPT to enhance the writing.)