offsec-debrief

Offsec Debrief & Writeup

Generate a structured writeup documenting the full challenge including both the successful attack path and every failure with structured analysis. Update MEMORY.md with generalized lessons.

---

Phase 1: Generate the Writeup

When to Use

• After completing a CTF challenge (HackTheBox, CTF competitions, etc.)
• When documenting penetration testing exercises
• For educational walkthroughs of security challenges

Data Collection (First Step)

Before writing anything, reconstruct the attack history from conversation context, workspace files, and any saved notes.

Writeup Structure

1. Header

# [Platform] - [Box Name] Writeup

**Difficulty:** [Easy/Medium/Hard]
**OS:** [Linux/Windows/Other]
**Category:** [Web/PWN/Wireless/Network/etc.]
**Target IP:** [IP Address]

2. Overview

• Brief challenge description
• High-level attack path summary
• Key vulnerabilities exploited
• Network architecture (if applicable)

3. Flags

| Flag | Value |
|------|-------|
| User | `[hash]` |
| Root | `[hash]` |

4. Attack Chain Summary

Visual representation of the successful path:

1. Initial Access Method → Result
2. Exploitation Step → Outcome
3. Privilege Escalation → Final Goal

5. Failure Track (REQUIRED — The Most Important Section)

This section is where learning happens. Every failed strategy must be documented with enough structure to extract patterns from.

Review all failed approaches from conversation context and workspace notes. For each failure, document:

## Failure Track

### F1: [Short description of what was attempted]
- **Strategy:** What technique/tool/CVE was tried
- **Target component:** What service/port/endpoint was targeted
- **Trigger signal:** What observation led you to try this (version number, error message, open port, etc.)
- **Result:** What actually happened (error messages, no output, wrong response, etc.)
- **Root cause:** Why it failed (wrong CVE for this config, network isolation, wrong layer, etc.)
- **Time spent:** How long before pivoting
- **Stop signal missed?** Was there an early indicator this wouldn't work that was ignored?
- **Rabbit hole type:** [Wrong CVE | Wrong exploitation method | Wrong layer | String filter | Session limitation | Other]
- **Rule for next time:** One-sentence decision rule to avoid this in the future

### F2: [Next failure...]