A writeup is a technical record of a challenge solution. It helps another learner reproduce the result and understand why the method works. It also helps you identify gaps in your own understanding.
Check the publication rules
Some competitions do not permit public solutions while an event is active. Read the rules before you publish a writeup. You can keep private notes during the event and publish later if the rules allow it.
Use a clear structure
- Challenge: Give the title, category, and short task description.
- Scope: Identify the supplied system, file, or program.
- Evidence: Record the important facts that you observed.
- Hypothesis: Explain what you thought the evidence meant.
- Tests: Show the commands or actions that confirmed or rejected the hypothesis.
- Solution: Give the final method and the flag format. Redact the flag when rules require it.
- Lesson: Explain the security concept and how a secure design prevents the problem.
Show enough evidence
Include the request, response, file property, code section, or calculation that supports the next step. Do not include every line of tool output. Select the part that proves the claim and explain it.
If a script performs the solution, describe its input, important operation, and output. A code block without an explanation is difficult to learn from.
Use consistent terms
Use one name for each item. If you call an item the “session cookie” in one section, do not call it a “token” later unless it is a different item. Define uncommon abbreviations at first use.
Remove unsafe information
- Remove passwords, private keys, session identifiers, and personal information.
- Do not publish access details for a system that remains active.
- Do not include data from another participant.
- Replace a live hostname with a documented placeholder when necessary.
- Credit tools, references, teammates, and prior research.
Review for reproduction
Read the writeup as if you did not solve the challenge. Check that the steps are in order, commands include necessary inputs, and each conclusion has evidence. Ask a teammate to follow the explanation.
Quality test: A reader should understand both how the challenge was solved and what security concept the challenge teaches.
A compact template
Title and category
Challenge goal and scope
Initial evidence
Hypothesis
Tests and observed results
Final solution
Security lesson
References and creditsUse the template as a starting point. Add detail only when it helps the reader reproduce or understand the method.