┌─────────────────────────────────────────────────────────────────┐
│  Step 1: Information Disclosure                                  │
│  GET /storage/logs/laravel.log → 30MB debug log                 │
│  Contains: bcrypt hashes, user dumps, server paths              │
│  Extracted: cncmeng / 123123 (weak password, cracked from log)  │
└──────────────────────────────────┬──────────────────────────────┘
                                   ▼
┌─────────────────────────────────────────────────────────────────┐
│  Step 2: WAF Bypass (nginx rule evasion)                         │
│  POST /login normally returns nginx 404 (WAF blocks)            │
│  Bypass: Add Origin + Referer + Sec-Fetch-* headers             │
│  Result: Login returns 200 + {"actionRequired": true}           │
└──────────────────────────────────┬──────────────────────────────┘
                                   ▼
┌─────────────────────────────────────────────────────────────────┐
│  Step 3: 2FA Brute Force (4-digit email code)                    │
│  Code generation: rand(1000, 9999) = 9000 possibilities         │
│  Validity: 2 minutes, NO rate limiting                           │
│  Speed: ~4-5 req/s serial, avg 5 attempts to hit               │
│  Result: verify → auth()->loginUsingId() → full session         │
└──────────────────────────────────┬──────────────────────────────┘
                                   ▼
┌─────────────────────────────────────────────────────────────────┐
│  Step 4: Subscribe to any creator                                │
│  POST /buy/subscription {id, interval:monthly,                   │
│                          payment_gateway:wallet}                  │
│  cncmeng wallet has sufficient balance (¥20,961)                │
│  Result: {"success": true}                                       │
└──────────────────────────────────┬──────────────────────────────┘
                                   ▼
┌─────────────────────────────────────────────────────────────────┐
│  Step 5: Scrape video URLs                                       │
│  GET /ajax/updates?id={creator_id}&skip={0,5,10,15...}          │
│  Subscribed session sees full content including video URLs       │
│  URLs: /public/uploads/updates/videos/{creator_id}{hash}.mp4    │
└──────────────────────────────────┬──────────────────────────────┘
                                   ▼
┌─────────────────────────────────────────────────────────────────┐
│  Step 6: Download (no auth required)                             │
│  Video files served by nginx with NO authentication check        │
│  Direct GET request downloads the file                           │
└─────────────────────────────────────────────────────────────────┘