$ cat ~/docs/README.md

// Docs

How to write and format CTF writeups for the 518&imposter blog.

# Frontmatter (YAML Header)

Every .md file starts with a YAML block between --- markers. This is how the site knows the title, author, category, etc.

$ cat frontmatter-example.yaml 
---
title: "SQL Injection in Login Panel"
date: 2026-04-20
ctf_event: "BITSCTF 2026"
challenge_name: "login_bypass"
category: "Web"
tags: ["sql-injection", "auth-bypass", "python"]
points: 300
difficulty: "Medium"
description: "Bypass authentication via SQL injection in a custom login form."
author: "DeFexGG"
draft: false
---

# Fields Reference

Field Type Required Description
title string ✓ Title of the writeup
date YYYY-MM-DD ✓ Date of the writeup
ctf_event string ✓ CTF event name, e.g. "BITSCTF 2026"
challenge_name string ✓ Challenge slug, e.g. "login_bypass"
category enum ✓ Reverse | Pwn | Web | Crypto | OSINT | Web3 | Forensics | Misc
tags string[] — Tags for filtering, default: []
points number — Challenge points
difficulty enum — Easy | Medium | Hard | Insane
description string — Short description for SEO and previews
author string — Your nickname. Shows up under the title
draft boolean — Set to true to hide from site. Default: false

# Markdown Body

After the frontmatter, write your writeup using standard Markdown. Here are the supported elements:

Headings

## Challenge Description      ← h2 (main sections)
### Step 1 — Recon             ← h3 (sub-sections)
#### Finding the endpoint      ← h4 (details)

Code Blocks

```python
import requests

url = "http://target.ctf/login"
payload = {"user": "' OR 1=1--", "pass": "x"}
r = requests.post(url, data=payload)
print(r.text)
```

Supported languages: python, javascript, bash, c, rust, sql, html, and many more.

Images

![screenshot description](screenshot.png)

Put images in the same folder as your .md file. Use relative paths.

Inline Formatting

**bold text**
*italic text*
`inline code`
[link text](https://example.com)
~~strikethrough~~

Lists

- bullet item 1
- bullet item 2
  - nested item

1. numbered step 1
2. numbered step 2

Blockquotes

> This is a quote or hint from the challenge description.

Tables (GFM)

| Offset | Value  | Meaning   |
| ------ | ------ | --------- |
| 0x00   | 0x7f45 | ELF magic |
| 0x10   | 0x03   | x86_64    |

# File Structure

Place your writeup file and related images in the src/content/ctfs/ folder: 

src/content/ctfs/
├── My_Challenge.md        ← your writeup
├── screenshot1.png        ← images used inside
├── screenshot2.png
└── exploit.png

// Tip: The filename (without .md) becomes the URL slug. Use underscores for spaces.

# Full Example

Copy this template as a starting point for your writeup: 

---
title: "SQL Injection in Login Panel"
date: 2026-04-20
ctf_event: "BITSCTF 2026"
challenge_name: "login_bypass"
category: "Web"
tags: ["sql-injection", "auth-bypass", "python"]
points: 300
difficulty: "Medium"
description: "Bypass authentication via SQL injection."
author: "DeFexGG"
draft: false
---

## Challenge Description

We're given a login form at `http://target.ctf/login`.
The goal is to get the flag from the admin panel.

## Initial Analysis

Opening the page we see a login form with a username and
password field. The source code shows it sends a POST to
`/api/auth`.

## Step 1 — SQL Injection Discovery

Tried basic SQLi payloads in the username field:

```sql
' OR 1=1--
```

This returned a **200 OK** with the admin dashboard.

![admin dashboard](dashboard.png)

## Step 2 — Extracting the Flag

On the admin panel we can see the flag in the page source:

```html
<!-- flag: CTF{s0m3_fl4g_h3r3} -->
```

## Flag

`CTF{s0m3_fl4g_h3r3}`

# Tips

  • ▸ Always include author — this way people know who solved it.
  • ▸ Use draft: true to save work-in-progress writeups without publishing.
  • ▸ Keep images small — compress PNGs before committing.
  • ▸ Use headings (##, ###) to structure your writeup — they show up in the Table of Contents.
  • ▸ End every writeup with a ## Flag section containing the flag.
  • ▸ The ctf_event field groups writeups — make sure it matches exactly across all writeups from the same CTF.