Critiquing SomeOrdinaryGamers New Internet Video

August 21, 2025

Recently Mutahar known better as Someordinarygamers on Youtube, was on the receiving end of a video which alleged his past history of credentials were overstated or outright false, these where in relation to his claims of computer security / computer science and even software development experience. Without physical evidence of these claims, it’s impossible to definitively arrive at a conclusion. It is safe to assume however that Mutahar genuinely has an interest in computers and technology, which he has used to help construct his reputation as an authority on Youtube. Whether or not he has authority or is deserving of this status, is certainly a topic of debate and criticism.

Information Technology is an interesting field of study. Depending on the track or discipline you intend to pursue there isn’t really a clearly defined protocol when it comes to acquiring the knowledge and skills in something like networking or computer security. You could choose to take a more formal path and attend university or tertiary education provider and learn through a set curriculum. Alternatively you could acquire proprietary certifications from vendors like Cisco or ComptiA, choosing to either study in a paid classroom environment, by choosing to do what i have done for the majority of my learning by going down the path of self studying at home. Once ready you then pay for the final exam. If none of these learning paths interest you, learning everything on your own is certainly another route you could take to then use when finding entry-level employment, with the goal of upskilling from there. If a job isn’t your end goal, you could even just create a portfolio of knowledge through blogging, videos and volunteering etc. . and prove to the world you are an expert on the topic through a history of your own work.

Mutahar appears to be a hybrid of these. He has claims of past employment in some of these roles (highly contested mind you) but it appears his interest in technology has morphed into being exclusivley a hobby, rather than being used to upskill for employment reasons. Either way technology is no doubt a hobby which Mutahar likes to create content around, which he says is also an educational resource for his subscribers.

This is where we arrive at the video titled: “A CENSORSHIP-PROOF Internet Just Dropped…” and i have issues with alot of what he is attempting to explain, especially when it comes to how the internet functions, how overlay or virtual networks combat censorship and his frankly dystopian outlook on the future of the internet.

The New Internet Claim

Mutahar introduces us to something called BetaNet and goes on to describe it as a new fully decentralized censorship resistant network, intended to replace the public internet. This is just Verbatim what Betanet describes itself as under the Status and Scope section of it’s Github.

0:29 Time code to Mutahar’s description of Betanet being a fully decentralized network

Nothing wrong about using Betanet’s own description here but note that it’s not new information and it’s not any information of which he has expanded on to describe in his own words, which would demonstrate an understanding of what he is talking about. This will become a pattern as the video progresses, so just keep that in mind.

The Baseless Claim Of Internet Segregation

Mutahar uses this censorship description to segue into talking about internet privacy, of which he predicts will become a vastly different landscape within 6 to 12 months. Why does he predict this? Well his theory goes that governments worldwide are collaborating with the top tech companies to “Segregate internet users”. I had to do some quick research as i had never heard about internet segregation before but after learning what online segregation is i don’t think he means that the internet will facilitate class division, which is akin to what can be experienced in the real world but instead he appears to be alluding to entire countries becoming isolated, shutout and completely detached from the global internet. Think the Great Firewall of China or even North Korea, that’s the vibe he points to at least.

How will this be achieved? Mutahar again doesn’t go on to explain much beyond laws being introduced which require ID verification along with his other claim of big tech companies working alongside government to block access to sites, platforms or users when requested. We also don’t get any reasoning as to why governments around the world would want to do this, just a flimsy claim that it probably will. I think his opinion here is baseless, poorly reasoned and overall, a very cynical outlook which is bordering on disillusionment.

The Overlay Network

As the rambling continues Mutahar at one point says “Basically this is an overlay network onto the internet as it is.” which he is correct about, much like a VPN is also an overlay network. However, it is his future description of the TCP/IP suite of protocols, something he described as the second pillar of the internet that made me think that perhaps he hasn’t even got a basic understanding of networking beyond knowing things like IP addresses, DNS and switching/basic routing concepts.

I became unconvinced of any expert level knowledge when he described this self-named second pillar with the following description: “At a software level, the internet is just a set of technologies that allow computers to communicate with each other”. For the lay person i would be ok with that explanation as it does a fairly good job of summarizing what the internet is doing but Mutahar isn’t some guy learning about networks for the first time, he’s apparently a self-described expert and if you are also educating people about the topic, you should be using correct terminology. The internet isn’t software that allows computers to talk to each other but a series of interconnected networks all over the globe that use the TCP/IP suite of protocols to facilitate communication connected via a variety of physical media, like undersea cables, satellite, Wi-Fi, copper phone lines etc.

It’s also important to note that the internet is by design decentralised, even though there are centralised aspects like your ISP, the internet itself is not centralised. If a link goes down due to a fault or sabotage there are protocols which will do their best to dynamically change routing paths to ensure IP traffic will still arrive to its destination. There is no central point of failure.

Overlay networks you may not be suprised to learn are virtual networks which operate over the top of another network, so without the internet you could not route your VPN traffic, use BetaNet, access files on an IPFS network, browse TOR (Dark Web) or use any overlay that requires the basic routing functions of the internet. The reason I bring this up is Mutahar describes how BetaNet is creating a censorship free internet. In his own words he explains it as “so that the internet cannot be censored and websites cannot be easily taken down”. What he seems to be describing here is a completely new network. I’m not certain if Mutahar thinks BetaNet is somehow mirroring the current internet or just something that is built from scratch. Even though he initially qualified BetaNet as an overlay network he doesn’t seem to be describing the functions of BetaNet as such, judging by his own explanations and language, it comes across as being its own autonomous system that works outside bounds of the internet.

His language changes further into the video and he clarifies BetaNet “Obviously this is not meant to be a replacement to the internet. It’s actually something that apparently runs on top of the internet that we know of.” At this point I’m convinced he doesn’t know what he’s talking about. To be clear he’s right but when he then explains how it works, he forgets that very important point. Almost as if BetaNet is its own sovereign network, that is then unified with the internet, instead of operating as an overlay.

To add to this he describes a hypothetical where all ISP’s have implemented blocks so no-one can connect to a server you are hosting, a scenario he describes as essentially being disconnected from the internet. His solution is to use TOR or a VPN. Well that would work for clients being blocked from accessing your server but unless your website is hosted elsewhere, no-one is connecting to your server. If you cannot host online, you don’t have an IP address and you don’t have a connection the internet.

His hypotheticals and explanations are never fully thought out or explain how you could use his proposed solutions to combat these censorship scenarios. All we get is a surface level glossing over that his proposed solutions work.

The Mad Claim About M.A.D

Mutually Assured Destruction (M.A.D) this military doctrine has apparently been adopted by BetaNet. In a nutshell M.A.D is the concept where if one nuclear armed country attacks another nuclear armed country the response will be for the defender to immediately respond with nuclear launches of their own, essentially guaranteeing both parties are defeated but the theory also states that this ability to retaliate with equal or greater force can actually foster peace. An interesting concept if not a scary one to think about.

So why are we talking about this, it’s because the developers of BetaNet made the claim that any attempt to block or destroy BetaNet would mean that the internet would also be harmed, the claimed end result being that BetaNet is immune to censorship, as any attempt on its existence would mean a degradation of the internet too. A huge claim to make and one that even if hyperbole i think Mutahar just went along with, without trying to understand how this would actually work in practice.

Mutahar says “If you want to censor the internet, having these overlays or systems is going to be a situation where i guess mutually assured destruction exists between the people on the internet. So you can’t just remove things or delete stuff” this is a big and bold claim. In the video by K0 of Raven he also makes some huge claims himself, including that claim of taking down BetaNet would result in serious harm to the regular internet.

Don’t forget all of this is just a proposed protocol that only exists on paper. Mutahar also continues to explain that he would be 100% supportive of having some level of mutually assured destruction. Again we get no explanation as to why this would be a good idea, just more discourse about how the same six or seven big websites currently control censorship decisions. Because of this centralisation Mutahar see’s no incentive for these big companies to implement BetaNet into their “Infrastructure” and in a vacuum this rationalization makes sense but being an Overlay network you should be able to still access Facebook for example, even if they aren’t running a BetaNet node, so this doesn’t track in reality.

Take this quote from Mutahar “They don’t necessarily need this nuclear weapon on the internet that prevents each other from uh absolutely, you know, modifying things on the internet.” There is again a lack of explanation of how implementing a M.A.D protocol can stop modification or how this would work as websites are not stored on an immutable database. This is something that was spouted by web3 grifters when they would hype up the idea of using blockchain networks to create immutable sources of information. Nothing in the BetaNet protocol points to it using technology that could achieve this, where Mutahar got this idea from is beyond me, it just doesn’t make any sense.

How The Internet Works According To Mutahar

Mutahar tried to explain what the internet was using three pillars

  • Hardware – Which includes fiber lines, data centers, internet backbone, ISP’s, routers
  • Software – A bunch of technologies that help communication, IP address, servers
  • Government Agreements – Government and ISP agreements

I’m sure he was trying to simplify the explanation but in reality, he did a poor job. He just outright forgot to mention TCP/IP. He also said local governments are custodians of internet access when the reality is the Internet Assigned Numbers Authority and its regional sub branches are the custodians of IP address assignment. This is the controlling authority who you need to request IP addresses from. This is how ISP’s get IP addresses they can then assign to its subscribers. Without going into too much detail, this pillar explanation is not something you would expect from someone who claims to have more than just a basic understanding of networking.

Avoidance, Confidently Wrong & A Surveillance State Internet

BetaNet uses cryptocurrency to help incentivize hosts to stay online, which is an incentive structure that has been directly taken from blockchain networks, with Bitcoin being the most well known. Alongside that cryptocurrency mechanic they also seem to be utilising a voting system which calculates a metric based on your uptime and amount of e-cash staked (which is a red flag). Mutahar says this could be a problem, as those with more money could essentially game the system, which is something i agree with. This is exactly the same issues that are present in many cryptocurrency governance systems, which ironically is why most of the big ones end up centralising this function, even at the behest of its clients. BetaNet supposedly has this, so any changes made to the network protocol could be democratically voted upon by those invested in it, instead of a central controlling authority having the final say. All of this Mutahar fails to breakdown and explain, he just refers you to “There’s other comments that talk about that, just refer to those.” A great tactic to use when you need to deflect questions because you don’t know what you are talking about.

Mutahar also briefly described alternative overlay networks with one such being the Yggdrasil network. Unfortunately for the uninitiated, he again only gets half of the information right. He correctly explains that it uses a mesh network topology (not confidently in my view) but then without faltering says you can go off grid using it, implying that you can completely avoid the internet and communicate with other nodes without it. This is wrong, it’s an overlay network that is attempting to create a routing protocol that can react to downed links fast then choose the shortest physical path when delivering packets. All he did was read their summary and quickly conclude its use.

He mentions something named Reticulum and just straight up reads word for word their description, again fails to explain and demonstrate knowledge on the subject.

His censorship crusade continues and so do the ludacris claims like: “We’re going to have a point where tonnes of, because of all of these laws, a lot of websites are going to have to shutter down because they can’t cater to every single law that is being propped up in every big country in the world” Unless he thinks China or Iran are going to somehow gain routing control and authority over the entire internet, this scenario is not going to happen, especially on the scale Mutahar thinks it will. Especially when we arrive at the claim of the internet becoming a “mass surveillance dog shit internet” arguably this is happening (somewhat but more at the platform level), but i suspect Mutahar predicts a very radical version of surveillance here.

The Red Flags Exist

When it comes to understanding BetaNet there is alot of terminology and seemingly complex processes that are explained in its specification document on GitHub. Taking it as a whole it looks impressive but when you start to break down what BetaNet is apparently using to achieve its end goal, red flags start appearing and for someone of Mutahar’s experience he should of atleast noticed one or two. I’m certainly not claiming that i have discovered all the flaws or even understand 100% what is going on in the documentation but it’s not hard to research and attempt to connect the dots.

I planned to outline some of the anomalies i found but i fear this article is becoming a much larger piece than i first planned, so maybe it’s something i will post about separately. Separately, since that video went up on his Youtube, he has already posted a number of new videos which all point back to internet censorship interestingly. It’s clear to see that censorship resistance is a huge issue that Mutahar is fighting for and fighting for what i believe is the right side too. However since those first videos, which shone a light on his potential lack of knowledge, it has become pretty clear that Mutahar isn’t as skilled in some of those areas as his past claims make it seem.

Lessons Learnt

This isn’t about hating on the guy, trying to catch him in a gotchya or even gatekeeping but more about trying to put into context where his knowledge may really lie. Because if there is one thing i think he is very wrong about, it’s just how severe and dystopian his outlook is on the future of the internet. He is very doom and gloom with his predictions in what can only be described as a paradigm shift in internet freedoms, which will all be coming within 12 months time. We should all be fighting for a freer internet and anyone who was around in the early days understands better than anyone how it was a fun and adventurous place to explore, it still can be and still is. At the end of the day when it comes to changing things we don’t want, speak with your wallet and do your best to find alternatives to services which are censoring users. This isn’t always easy, or practical but if things do get as bad as Mutahar claims we are the ones who hold the power, without us, the user, these companies are nothing.

I hope Mutahar continues to make content on things he enjoys in technology but there is no shame in admitting you don’t know something, you come off so much worse if you attempt to lie your way through a topic, instead take that time to research and share that with your audience. At the end of the day, you will become a better operator for doing so, while also creating a more informed and tech literate audience too.

Thanks for coming to my Ted Talk


Lab: Method-based access control can be circumvented

May 6, 2025

  • Application access controls based partly on HTTP method of requests
  • Admin panel: administrator:admin
  • Login using admin:administrator to observe admin panel
  • To Solve: exploit flawed access control & elevate to administrator
  • Login: wiener:peter

  • Login to administrator and observe upgrading user and the HTTP requests
  • Observe POST request which requests /admin-roles with the parameters of username=wiener&action=upgrade (Our upgrade paremeter)
  • Login to wiener and copy session ID
  • Send the POST request to repeater and change session ID to that of current user wiener
  • Send altered request to server, response will be 401 unauthorized
  • Change POST to POSTX will render a missing parameter “username” message
  • Change response to a GET request and and the username=wiener&action=upgrade parameters immediatley after the GET (right click, change request)
  • Solved

Lab: User role controlled by request parameter

April 21, 2025
  • Admin panel at /admin , which id’s admin using a forgeable cookie
  • Solve by accessing admin panel and delete user ‘carlos’
  • user – wiener pass – peter

  • /admin loads but no access
  • login to user shows admin access is controlled by cookie boolean value
  • change from false to true
  • reload of /admin gives access to admin panel

Lab: Unprotected admin functionality with unpredictable URL

April 21, 2025

  • Contains an unprotected admin panel
  • Located at an unpredictable location
  • Location is disclosed within the application
  • Access and delete user ‘carlos’

  • admin script loaded with website
  • amend url loads panel

Lab: Unprotected admin functionality

April 19, 2025

  • Contains an unprotected admin panel
  • Delete user carlos for solve

  • Ammending URL with /admin has no results
  • amending /robots.text uncovers the following- Disallow: /administrator-panel
  • navigating to /administrator-panel loads an unprotected admin dashboard
  • A list of users is available where we can delete them at will

Lab: File path traversal, validation of start of path

April 13, 2025
  • Vulnerability contained within display of images
  • Application transmits full file path via a request parameter
  • Path validation by checking path begins with expected folder
  • /var/www/images

  • GET request list full path
  • GET /image?filename=/var/www/images/20.jpg
  • A good indication path validation is enabled
  • GET request using full path and path traversal returns 200
  • GET /image?filename=/var/www/images/../../../etc/passwd

Lab: File path traversal, traversal sequences stripped with superfluous URL-decode

April 13, 2025

  • File path traversal vulnerability contained in images
  • Application will block input containing path traversal sequences
  • Application performs URL DECODE before using path
  • Retrieve contents of /etc/passwd file

  • URL encoded ../ charcters
  • %2e%2e%2f – single
  • %252e%252e%252f – double encoded
  • ..%c0%af -non-standard
  • ..%ef%bc%8f -non-standard

  • Standard traversal characters returns 400 Bad Request / No Such File
  • Single URL encoded ../ characters returns 400
  • Also encoding etc/passwd returns 400
  • Double encoded %252e%252e%252f with /etc/passwd returns 200 and file contents in repeater

Lab: File path traversal, traversal sequences stripped non-recursively

April 13, 2025
  • Vulnerability contained in images
  • Application strips traversal sequences from user supplied filename
  • Retrieve contents of etc/passwd
  • Use of nested traversal sequences

  • Load Product Page
  • Intercept GET request for image
  • Original GET request returns 200
  • File traversal using ../ is stripped
  • However using nested traversal ….// traversal can work
  • Solved using ….//….//….//etc/password
  • Server response listed file contents

Lab: File path traversal, traversal sequences blocked with absolute path bypass

April 12, 2025

Using Burp Suite:

  • Contains path traversal vulnerability in product images
  • Application blocks traversal sequences
  • Treats supplied filename as absolute
  • Solve = retrieve contents of /etc/passwd
  • Intercepted GET request for product image
  • Sent to Repeater
  • Original Request ‘GET /image?filename=17.jpg’ returns 200 OK
  • Using absolute path /image?filename=/etc/passwd returns contents in response
  • ../ traversal was blocked

Burp Suite response returns the contents of the /etc/passwd file


HTML5 Forms

July 11, 2024

Forms and their attributes

<form>
All the form elements are placed between this tag

action=”url” – The action attribute points to the URL where the forms information will be submitted<

method=”get” or method=”post”- Forms are sent using either the get or post

Values from the form will be added to the URL specified in the ACTION attribute

GET is used in the following form situations:
– Short forms like search
– When only retrieving data from the server

POST method sends the values as HTTP headers and are used for the following forms:
– Upload forms
– Very long forms
– Forms which contain sensitive data
– When adding or deleting information from a database

If no method is set (POST or GET) the form will default to using the GET method

The <input> element is used to create several types of form controls, the value of the type= attribute will determine what kind is created.

Other form elements and attributes include:

– type=”text” – creates a single line output
– name=” ” – identifies the form control for the server
– mexlength=” ” – used to limit the number of characters on a form
– type=”password” – single line text that blocks the input
– element creates a multiline form, text that is coded between the opening and closing tags will appear in the form box
– type=”radio” – creates radio buttons of which only one can be selected
– value=” ” – indicates the value sent to the server of the selected button
– <selected> – this attribute can be used to have a button selected when the page loads
– type=”checkbox” – allows selection of one or more options
– <select> – creates a drop down list
<option> – used with the select element to create options the user can choose
– size=” ” can be used with select to set how many drop down options can be seen
– <multiple=”multiple”> – allows users the pick more than one drop down option
<input> – element is used to allow file uploads
– type=”file” – creates an upload form, method must be set as POST
– type=”submit” – creates a submit button
– type=”image” – can be used to create an image submit button
– type=”hidden” – hides a form on the page
– <button> – element allows more control over button appearance, combine text and image between opening and closing tags
– <label> – identifies the form and helpful for screen readers
– for=” ” – used alongside LABEL and identifies which form it belongs to and allows users to click text
<fieldset> – use to group related forms, browser will show line around group
<legend> – id’s the form group and appears as a form header
– type=”date” – creates a date selection box
– type=”email” – use for email form and also optimizes for smartphone keyboard
– type=”URL” – used when asking for a URL and HTML5 will validate a url as input
– type=”search” – creates a single line search form
– placeholder=” ” – text written in the placeholder attribute shows up in the text form

<html>
    <head>
        <title>Forms</title>
    </head>
    <body>
        <form action="http://www.example.com/review.php" method="get">
            <fieldset>
                <legend>
                    Your Details:
                </legend>
                <label>
                    Name:
                    <input type="text" name="name" size="30" maxlength="100">
                </label>
                <br />
                <label>
                    Email:
                    <input type="email" name="email" size="30" maxlength="100">
                </label>
                <br />
            </fieldset>
            <br />
            <fieldset>
                <legend>
                    Your Review:
                </legend>
                <p>
                    <label for="hear-about">
                        How did you hear about us?
                    </label>
                    <select name="referrer" id="hear-about">
                        <option value="google">Google</option>
                        <option value="friend">Friend</option>
                        <option value="advert">Advert</option>
                        <option value="other">Other</option>
                    </select>
                </p>
                <p>
                    Would you visit again?
                    <br />
                    <label>
                        <input type="radio" name="rating" value="yes" />
                        Yes
                    </label>
                    <label>
                        <input type="radio" name="rating" value="no" />
                        No
                    </label>
                    <label>
                        <input type="radio" name="rating" value="maybe" />
                        Maybe
                    </label>
                </p>
                <p>
                    <label for="comments">
                        Comments:
                    </label>
                    <br />
                    <textarea rows="4" cols="40" id="comments">
                    </textarea>
                </p>
                <label>
                    <input type="checkbox" name="subscribe" checked="checked" />
                    Sign me up for email updates
                </label>
                <br />
                <input type="submit" value="Submit review" />
            </fieldset>
        </form>
    </body>
</html>