Dangling Tree

This is a placeholder writeup. It exists so you can see how a real one looks — the file-info block above, section headings, code blocks with a copy button, and screenshots sitting next to the Markdown. Replace it (or delete the folder) when you write your first real one.

The structure below is how I tend to organise a box: recon, then foothold, then privilege escalation, then a short reflection on what the box was actually teaching.

Recon

I start every box the same way — a full port scan, then targeted version detection on what’s open. Keeping the output files around (-oA) means I can grep them later instead of re-scanning.

nmap -p- --min-rate 2000 -oA scans/all 10.10.11.42
nmap -sC -sV -p22,80,3000 -oA scans/targeted 10.10.11.42

The thing worth writing down here isn’t the commands — it’s the observation. Port 80 and port 3000 look like the same application at two different stages of deployment, and that gap is usually where the interesting findings live.

Note-taking

I keep one Markdown file per box open the whole time and paste findings into it as I go. The writeup is mostly an edit of those notes afterwards, which is why writing them up barely takes extra time.

Foothold

This is where you’d walk through how you got your first shell: the service you looked at, what you noticed, and the step that actually worked. Favour explaining why a thing was exploitable over pasting a long payload — future-you reads the reasoning, not the bytes.

POST /api/example HTTP/1.1
Host: dangling.htb
Content-Type: application/json

{"field": "value"}

Privilege escalation

Same idea for the root step. One or two commands that mattered, a sentence on the misconfiguration behind them.

sudo -l

Reflection

A couple of sentences on what the box was really about. For me the value of a writeup is this part: a box is only worth solving twice if I can name the pattern it taught me, so I can spot it on the next target.