How to write writeups

A writeup documents how you solved a challenge: the path, the tools, and the reasoning. Writing them consolidates your learning, demonstrates your skills (portfolio/employment), and helps the community. A good writeup is understandable and reproducible step by step.

Why write writeups

- LEARN: explaining something cements the knowledge far more than just solving it
- PORTFOLIO: they show your level to recruiters/community (personal brand)
- COMMUNITY: they help others and position you
- REFERENCE: your own archive to reuse techniques in the future

Structure of a good writeup

Intro        challenge, platform, category, difficulty; a one-line summary
Enumeration  what you found and how (relevant commands and outputs)
Exploitation  the path to the flag, step by step and with the WHY of each decision
Escalation   (boot2root) from user to root
Conclusion   what you learned; mitigation (defensive side)

Keys to a good writeup

- REPRODUCIBLE: exact commands, screenshots, enough context to follow it
- explain the WHY, not just the what ("I tried X BECAUSE I saw Y")
- include the relevant dead ends (they teach as much as the solution)
- concise but complete; clear formatting (markdown, code blocks, images)
- defensive side: how it would have been prevented (adds value and blue-team perspective)

Ethics (very important in active CTFs)

- do NOT publish writeups of ongoing CTFs or paid content without permission (e.g. active HTB)
- wait for the machine/challenge to retire or for the competition to end
- respect the platform's disclosure rules

Where and how to publish

- your own blog (GitHub Pages, Hugo), Medium, or a writeups repo
- good SEO/clear titles -> so they get found; tag by category/technique
- consistency: one writeup per solved challenge builds a portfolio over time

Blue Team / learning

Writing the writeup consolidates what you learned: explaining it reveals what you didn’t fully get.
Prioritize reproducibility and the why of each decision, not just the commands.
Including the defensive side (mitigation) adds perspective and blue-team value.
Respect ethics: never leak active or paid machines/challenges.

Tips and common mistakes

Write the writeup as you solve (commands, screenshots); reconstructing from memory loses details.
Explain the why, not just the what: a good writeup teaches the reasoning, not pasted commands.
Common mistake: publishing writeups of active challenges or boxes (breaks the rules); wait until they retire.

Testing checklist

Document during the challenge (don’t reconstruct from memory later)
Clear structure (intro/enum/exploitation/escalation/conclusion)
Exact commands and screenshots (reproducible)
Explain the WHY of each step, not just the what
Include relevant rabbit holes and mitigation (defensive)
Respect ethics (nothing active/paid without permission)
Publish and tag by category/technique (portfolio)