01 / Why I Write Them
For me, completing a CTF is only part of the learning process.
It is possible to find the right command, follow an exploit path, and capture a flag without fully understanding why the attack worked. Writing everything down afterward forces me to reconstruct the process and explain it clearly.
I have to ask:
- What information did I start with?
- Why did a particular service look interesting?
- Why did I choose one technique over another?
- What failed, and what did that tell me?
- What vulnerability actually made the attack possible?
That extra step turns a completed challenge into something I can learn from again later.
It also creates proof of work.
Listing tools such as Nmap, Burp Suite, or Metasploit on a resume only says that I have used them. A write-up shows how I actually apply them, how I interpret their output, and how I work through a technical problem when the answer is not immediately obvious.
02 / My Process
I try to approach each challenge as an investigation rather than immediately looking for an exploit.
The process is rarely perfectly linear.
Most challenges involve repeatedly moving through:
observation → hypothesis → test → new information
until an attack path becomes clear.
In the write-up, I try to preserve that reasoning instead of only showing the final successful commands. Failed approaches are often useful because they show why I changed direction and what information led to the next step.
03 / What I Focus On
I am less interested in documenting every command I typed and more interested in explaining the parts of a challenge that actually changed my understanding.
My write-ups mainly focus on:
- Enumeration — understanding what information a target exposes and deciding what deserves further investigation
- Service analysis — identifying how exposed services work and what their configuration tells me
- Web exploitation — investigating authentication, input handling, file uploads, CMS platforms, and other web attack surfaces
- Linux privilege escalation — understanding permissions,
sudo, services, binaries, and misconfigurations that can cross privilege boundaries - Tool interpretation — understanding what tools such as Nmap, Burp Suite, Metasploit, and SQLmap are actually telling me rather than treating their output as the answer
- Attack chains — understanding how several smaller findings can connect into a complete compromise
- Failed approaches — recording why something did not work and what that failure revealed
- Root cause — going back after exploitation and understanding the underlying vulnerability or misconfiguration
The main question I try to answer is not just:
How did I solve this box?
but:
What did this box teach me that I can recognize again somewhere else?
04 / Why This Matters to Me
Cybersecurity has a huge amount of information to learn, and it is easy to mistake completing a tutorial or challenge for actually understanding the subject.
Writing forces me to test that understanding.
If I cannot explain what I saw, why it mattered, why I chose the next step, and why the vulnerability worked, then I probably do not understand it as well as I thought.
That is why I see these write-ups as more than a collection of completed CTFs.
They are both a learning record and a public record of the work behind the skills I am developing.