Lesson 2 of 4 in The Bug Between Two Features · 5 min left in this chapter

The Defender Sees Nothing

No alert, no anomaly, no log entry anywhere on the forum. That absence is the defining property of this attack.

2 min read

Not yet reviewed

Every other attack in this curriculum leaves something. A brute force fills the auth log. An injection leaves a strange query. A traversal leaves a request for a path that should not exist. This one leaves nothing at all, and the absence is worth its own lesson.

The forum's own record of the incident

everything the forum logged

198.51.100.44 - - [02/Mar/2026:14:02:11] "GET /u/marlow HTTP/1.1" 200 8402

# That is it. One profile view, answered normally, by a member who is
# allowed to view profiles. There is no second line.

The request to the attacker's server never touched the forum. It was made by the visitor's browser, directly, after the page had already been served — so the forum has no record that it happened and no way to have one.

What was actually stolen

A member's IP address
Their browser and operating system
The exact time they were reading
Enough, with the panel, to attach all of it to a name

What the forum could see

A profile page was viewed.

These are not two views of one event. The left column happened somewhere the forum cannot observe, which is why no amount of log review would have surfaced it.

Why this matters more than it sounds

Most security work assumes that if something bad happens, evidence exists somewhere and the job is finding it. This is the counter-example. There was no incident to detect, no alert to tune, and no threshold anybody could have set.

Note

A control that produces no telemetry cannot be monitored, only designed out. That is the general lesson: when a feature can be abused invisibly, "we will watch for it" is not a mitigation, and treating it as one is how a risk gets accepted on paper and never revisited.

Wrenlearner

Could they have noticed the avatar URLs at least? Somebody pointing an avatar at a server nobody has heard of seems checkable.

Rookmentor

That is exactly the right instinct, and it is the detection beat. It is not free — most remote avatars are perfectly innocent, hosted on image sites — so the signal is weak. But it is the only signal there is, and weak is different from absent.

Why is "we will monitor for this" a weak mitigation here?