Application-level Denial of Service on the OverTheWire CTF platform

While solving an upload vulnerability challenge on OverTheWire, I discovered an unintended application-level Denial of Service vector. The challenge allowed users to upload files to the server, expecting participants to exploit a classic file upload vulnerability. However, due to misconfigured server permissions, I was able to upload a malicious .htaccess file, which let me override Apache directives and effectively disable an entire module — taking down not only the target challenge but all subsequent ones depending on it.