CTFs are my lab. After dozens of challenges on web, Linux, and networking, a few lessons stick:

Read the source

Almost every web challenge hides a hint in comments, JS bundles, or response headers. Enumeration beats guessing.

Fail faster

When an attack path stalls, I switch vectors instead of grinding. SQL injection → auth bypass → IDOR — the app usually leaks somewhere.

Document while you solve

Write-ups force clarity. If I can’t explain the exploit chain, I don’t truly understand it.

These habits map directly to professional pentesting — same methodology, higher stakes.