Foysal Mahmud — Ethical Hacker — sat down with চলতি for a dedicated interview session on Ethical Hacking & Cybersecurity: what authorized hacking actually looks like, how real attacks unfold, and what ordinary people and businesses can do today to stay safe. This page is the complete case study of that session.
Most people only meet the word “hacker” in headlines — after a breach, a stolen account, or money gone from a mobile wallet. The work that prevents those headlines is almost invisible. This session with চলতি put that invisible work in front of a general audience: what an ethical hacker is hired to do, where the legal line sits, and why the same techniques that protect a system in authorized hands become a crime without permission.
For Foysal Mahmud, the interview was also a chance to translate a technical craft into plain language — recon, vulnerabilities and reports became stories about trust, evidence and responsibility. Security awareness only works when non-technical people can act on it, and that translation is the point of sessions like this.
“I break into systems — legally — so criminals can't.”
— Foysal Mahmud · operating principle, discussed in the sessionSix themes structured the conversation — from the definition of the craft to a checklist any viewer could apply the same evening.
Authorization is everything. An ethical hacker works under a signed scope — what may be tested, what is off-limits, and how findings are handled. The same action without permission is simply a crime, whatever the intention claimed afterwards.
Real intrusions rarely look like movies. Attackers start with public information — exposed accounts, forgotten subdomains, leaked credentials — then chain small weaknesses together. Recon first, spectacle never.
Phishing pages, fake support calls and “urgent” messages compromise more accounts than exotic exploits. Password reuse turns one old leak into every account a person owns — which is why habits, not just tools, decide safety.
Launching first and securing later, staging servers left public, admin panels protected by hope. The session walked through why a pre-launch audit is cheaper — in money and reputation — than a post-breach apology.
Not a scare, a system: risk-rated findings with proof, a remediation roadmap, and a re-test after fixes. The report is the product — evidence a team can act on, in the order that matters most.
For students watching: Linux, networking fundamentals and one scripting language before any “hacking tool”. Methodology outlasts tools — and documented, authorized practice is how a portfolio gets built.
চলতি published the session as a three-part video series on their YouTube channel. Press play to watch right here — videos load only when you tap them, so this page stays fast.
চলতি · YouTube
What to know before you use your mobile — the everyday risks hiding in the device already in your hand.
Open on YouTube
চলতি · YouTube
Traps are everywhere — phishing, fake offers and social engineering — and this is how you avoid them.
Open on YouTube
চলতি · YouTube
Beware of hacking — how accounts actually get taken over, and the habits that keep yours yours.
Open on YouTubeALSO ON FACEBOOK — the session was published there in two parts: Part 1 · Part 2
Offensive security with a defensive conscience. Foysal Mahmud is hired to think like the adversary — probing web applications, networks and human-facing systems for the weaknesses others miss — then helps close them properly, permanently, and with evidence. Alongside client work, he speaks on national platforms about cybersecurity awareness, and builds secure software by design.
Yes — when it is authorized. Ethical hackers work under a signed scope from the system owner. Testing a system you do not own or have written permission for is illegal, regardless of intention.
A risk-rated report: each finding with proof-of-concept evidence, its business impact, and a remediation roadmap — followed by a re-test once fixes are in place.
Start with Linux, networking fundamentals and one scripting language (Python). Practice only in authorized labs, document everything, and build methodology before collecting tools.
Yes — engagements are available for web applications, APIs, networks and security consulting. Use the contact section of the main portfolio; response time is under 24 hours.
The interview explains the philosophy. An engagement applies it to your website, app or network — before someone with worse intentions finds the same doors.
Start an Engagement See Field Records