Every year picoCTF gives you two weeks to break things safely, and every year I walk away sharper than I started.
This year my favorite solves were the format-string one and the web-auth chain. The format-string bug taught me to read what the program actually does with input rather than what I assumed it did, and the auth chain was a reminder that a logic flaw can matter more than any parser bug.
What I keep coming back to is the habit. Trace the data, write down what you expect, then check. Most of the time I lost on those challenges was spent guessing when the answer was sitting in the response.
The write-up versions live in my public notes. The short version is that boundaries are worth more than the cleverest payload.