Step 277. Speed Training: Medium in Under 8 Hours — Stamina and Pace Allocation for the Long Game

Level 3 — Real-World CTF & Advanced Offensive Skills | Difficulty ★★★★☆ | Estimated time: 1 day (8-hour time attack + 1-hour retrospective)

Prerequisites: the parallelization and lap-time recording habits from Step 276 (Easy in 4 hours), experience completing multiple Medium machines.

What you need: one never-before-seen HTB or THM Medium machine, a timer, a lap-time log, a memo for hourly self-reports, and a meal/rest plan. The machine assault scenes in this chapter are screen examples.
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. Hack The Box (hackthebox.com) and TryHackMe are legal learning platforms officially opened by their operators for attack practice — do not use today’s techniques on anything except these platforms’ machines.
This is a training methodology chapter. It extends what you learned in the Easy sprint (Step 276) to the 8-hour long game.

A Medium 8-hour run is almost exactly the pace of a competition day. If the Easy 4 hours was a sprint, Medium 8 hours is a middle-distance run — sprint technique (parallelization, templates) alone isn’t enough, and a new event is added: pace allocation and stamina management.

The person who collapses in an 8-hour training run is usually not the one lacking skill — it’s the one who gets exhausted at hour 3. Today’s core question is not "how do I break in" but "how do I keep my judgment intact for 8 straight hours?"

1. Learning Objectives

By the end of this chapter, you will be able to:

Build a stage-by-stage budget table for a Medium 8-hour run (enum 2h / foothold 3.5h / privesc 2h / slack 0.5h)
Write an hourly "current position / next action" self-report to detect derailment early
Apply a decision rule for "continue vs. change route" when a budget is overrun
Manage long-game focus with a 50-minutes-work / 10-minutes-rest rhythm
Use mid-run saves (records) to stay resumable no matter when you stop

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	HTB/THM Medium machine, Kali or WSL, timer (with rest alarms)
Today’s commands	All review — Step 276’s parallelization and templates + hourly self-reports
Concepts needed	Time budgets, decision rules, the 50/10 rhythm, mid-run saves
Today’s deliverable	8-hour lap-time log + hourly self-reports + budget-vs-actual retrospective

2-1. Medium’s Budget Table — How It Differs from Easy

What makes Medium harder than Easy is not technique but the number of paths. On Easy there are 2–3 candidates, so you break them in order; on Medium the enumeration results are two to three times larger, and the real entrance is mixed in among fake ones. So the budget differs too.

Stage	Budget	Goal	Difference vs. Easy
① Enumeration	0:00–2:00	Full attack surface + prioritized candidates	30 min → 2 hours. Not breadth — depth
② Foothold	2:00–5:30	First shell	1–2 fake-entrance experiences are included in the budget
③ Privesc	5:30–7:30	root/SYSTEM	Medium privesc is often multi-stage
Slack	7:30–8:00	Absorb overruns + close out records	—

The reason ① gets 2 hours matters. Medium enumeration is not scanning — it’s close reading: clicking through every feature of the web app, reading JS files, comparing API responses. The person who tries to save these 2 hours burns 5 hours in ②.

2-2. Decision Rules — Answer the Budget-Overrun Moment in Advance

This is the core of the material — budget overruns will happen; the problem is the judgment at that moment. Set the rule before you start.

[Decision rule — signed before starting]
When a path's budget is overrun, ask yourself:
1. "Has new evidence for continuing this path appeared within the last 30 minutes?"
   → Yes: grant one 30-minute extension token. One token per path, ever.
   → No: regress to the hypothesis tracker. Leave a marker (memo) on this path and discard it.
2. "Are there untested candidates left on the hypothesis tracker?"
   → Yes: move to the next candidate.
   → No: regress to enumeration (it means information is lacking — back to ①).

The value of this rule is moving the judgment earlier. The brain at stuck hour 5 whispers "keep going" — what you pull out then is the rule written by hour-0 you.

2-3. The 50/10 Rhythm — Focus Is Not Willpower but a Cycle

In 8 hours of continuous work, focus starts breaking around the 90-minute mark. Work after the break is not progress but repetition — retyping the same command, rereading output you already read.

The countermeasure is a cycle of 50 minutes work / 10 minutes rest. Rules:

The 10-minute rest is a screens-off rest — resting on your smartphone does not restore focus.
Rest alarms come from a physical timer — mid-immersion, you don’t see the clock. Rules are kept by devices.
8 hours = eight 50/10 cycles. Absorb meals by extending the 10 minutes between cycles 4 and 5 to 30 — only the person whose meal is on the schedule eats on time.

2-4. Mid-Run Saves — The Habit That Protects 8 Hours of Work

In the long game, recording is not a post-run task — it’s an in-progress task. At every self-report (on the hour), save three things.

Current state: what shell/access do you hold right now?
Verified facts: confirmed information (credentials, versions, closed paths).
Open hypotheses: what to try next, in priority order.

With these three, even if you get cut off mid-run (a dinner appointment, sleep, focus limits), the resumption cost is near zero. Conversely, get cut off after 6 hours with no save and the first hour of resuming is spent reconstructing "what was I doing?" On a Medium 8-hour run, records are not a report — they’re a save file.

3. Follow Along

3-1. Before Starting — The Budget Table and Self-Report Template

Once you’ve picked a never-before-seen Medium machine, create two documents first.

Input (lap-time log — same format as Step 276):

enum | 0:00

Input (hourly self-report template — invest 1 minute every hour):

[1:00 self-report]
- Current position: (which stage, what am I looking at)
- Next action: (one plan for the next 50 minutes)
- Off-track signal: (am I doing something not in the plan — yes/no)

Why: the "off-track signal" box is the heart of this template. Running an exploit during the enumeration stage, or still reading scan results during the foothold stage — most time theft in the long game happens as stage mismatch, and the 1 minute on the hour catches it.

3-2. ① Enumeration (2 Hours) — The Close-Reading Hours

Unlike Easy, Medium enumeration goes wide first and then deep. Keep using parallelization (Step 276), but the waiting time is spent differently — while scans run, you read what you’ve already found.

Screen example (a self-report from the enumeration stage):

[1:00 self-report]
- Current position: ① enum. Found the email-validation logic in the signup form's JS, reading it
- Next action: finish the /api/ endpoint list (4 more extracted from JS)
- Off-track signal: no — all scans are in the background; hands are on reading

How to read it: at hour 1, producing "found while reading" rather than "scan complete" is normal for Medium enumeration. The goal when you finish at 2:00 is not a list but a prioritized list.

3-3. ② Foothold (3.5 Hours) — The Fight Against Fake Entrances

The specialty of the Medium foothold stage is the fake entrance — a path that looks vulnerable but is blocked when you actually go. The 3.5-hour budget includes the cost of 1–2 fake entrances, so getting fooled once doesn’t ruin the plan.

Screen example (a log with the decision rule working):

[3:00 self-report]
- Current position: ② foothold. Burned 50 min on candidate 1 (suspected SQLi) — looked error-based but blocked by filtering
- Rule applied: no new evidence in the last 30 min → discard without spending the extension token. Memo: "candidate 1, needs filter bypass"
- Next action: candidate 2 (duplicate-username response difference at signup → account enumeration, then default credentials)

How to read it: a "discard" stamped in the log at hour 3 is not failure — it’s evidence of the rule working. The person who wins a Medium 8-hour run is not the one who never falls into a fake entrance, but the one who falls in and gets out on time.

3-4. ③ Privesc and Close-Out — Pacing a Multi-Stage Escalation

Medium privilege escalation often doesn’t end with "one misconfiguration" — it’s multi-stage: from user A’s shell to user B, then to root. Think of the 2-hour budget split by stage.

Screen example (the lap-time log completed):

enum | 0:00
enum | 1:55
foothold | 5:10      ← user shell (20 min under budget)
privesc | 7:20       ← root via a second account (10 min under budget)
notes | 7:50

How to read it: each line is "the elapsed time at which that stage ended." Including the slack stretch (7:30–8:00), even record close-out finished inside 8 hours. When you feed this to Step 276’s analyzer, only the budget changes — BUDGET = {"enum": 120, "foothold": 210, "privesc": 120, "notes": 30}.

3-5. After Finishing — The Retrospective Grades "Stamina" Too

The 8-hour retrospective has one more question than the Easy one did.

# Medium 8-hour retrospective — [machine name]
- Budget vs. actual by stage: (table)
- Decision-rule operation record: extension tokens used 0/1, discards N
- 50/10 rhythm compliance: N of 8 cycles — the times of broken cycles and the work quality right after
- TOP 3 time-consuming points and their causes
- 3 things to do differently on the next 8-hour run

Why: the reason you write rhythm compliance — look at the log right after a broken cycle and you’ll usually find "retried the same command." Only someone who has confirmed with their own log that fatigue is directly time loss will not turn off the rest alarm on the next run.

4. Missions & Exercises

Mission — Medium 8-Hour Time Attack and Stamina Retrospective

Set the budget table (enum 2h / foothold 3.5h / privesc 2h / slack 0.5h) for a never-before-seen Medium machine and start.
Write the decision rule (2-2) as sentences and sign it before starting.
Write the hourly self-report (current position / next action / off-track signal) — all 8 of them.
Keep the 50/10 rhythm, and schedule the meal between cycles 4 and 5.
Update the mid-run save (current state / verified facts / open hypotheses) at every self-report.
After finishing, complete the retrospective in the 3-5 format — rhythm compliance included.

Exercises

Exercise 1. Why is Medium’s enumeration budget (2 hours) four times Easy’s (30 minutes)? Explain why trying to save this time wrecks ②.

Exercise 2. Why does the decision rule limit extension tokens to "one per path"?

Exercise 3. Explain, from a focus-management standpoint, why you shouldn’t look at your smartphone during the 10-minute rest.

Exercise 4. Explain the principle by which the mid-run save’s three items (current state / verified facts / open hypotheses) reduce "resumption cost."

5. Model Answers & Completion Criteria

Mission Model Answer

Root within 8 hours is the ideal, but as in the source material’s completion criteria, "or cause analysis completed" also passes. Verification criteria:

8 self-reports: are the three boxes filled every hour on the hour? In particular, does "off-track signal" have a yes/no?
Traces of the rule: is at least one path discard or extension-token use recorded in the log? If you never got stuck once in 8 hours, either the machine wasn’t Medium or the log is shallow.
Save completeness: pick any one self-report at random — could you resume work from it alone?
Retrospective honesty: does rhythm compliance match the actual timer record? Be suspicious of 8/8 — perfect compliance in the long game is rare, and an honest 6/8 is far more valuable data.
Discovery of the stamina variable: is there an observation of "from what hour did the log’s density drop?"

Exercise Answers

Answer 1. Because Medium’s attack surface is two to three times Easy’s, and the real entrance is mixed among fake ones, so close reading (reading JS, comparing APIs, testing features) is required. Save those 2 hours and the candidate list carries no priorities, so in ② you try every path in no order — burn 50 minutes on each fake entrance and 3.5 hours vanish in no time. Enumeration’s 2 hours is the insurance premium that blocks foothold’s 5 hours.

Answer 2. Because unlimited tokens make the rule the same as no rule. "Just a little more" feels like new evidence every 30 minutes, but most of it is the same hope reheated. The 1-token limit creates a ceiling — "this path consumed at most 2 budget units" — capping the maximum loss on a wrong path. Only the person with a loss ceiling can reallocate time to the remaining candidates.

Answer 3. The smartphone’s information flow keeps injecting new stimuli and won’t let the brain exit work mode — the eyes rest but the attention system doesn’t. The purpose of the 10-minute rest is not "not looking at a screen" but recovering attentional resources. Turn off the screen and look out the window or stretch, and the next 50 minutes’ judgment returns. The quality of rest decides the log quality at hour 8.

Answer 4. Because most of resumption cost is "reconstructing context" — time spent re-testing how far you got, what’s confirmed, what’s unverified. The three items literally replace that reconstruction: current state gives the starting point, verified facts give the no-retest list, open hypotheses give the next action. The update cost of three lines (1 minute per hour) deletes one hour of resumption.

Completion Criteria Checklist

[ ] I built the Medium 8-hour budget table before starting
[ ] I wrote the decision rule (1 extension token, regression conditions) as sentences and signed it
[ ] I filled all three boxes of the hourly self-report 8 times
[ ] I kept the 50/10 rhythm and the meal schedule with a timer (compliance recorded)
[ ] A path discard or extension-token use appears in the log at least once
[ ] The mid-run save’s three items were updated every hour
[ ] I completed the retrospective including rhythm compliance and stamina observations

6. Common Pitfalls & Fixes

Wall 1. My focus falls off a cliff starting at hour 3

Symptom: you read the same output three times and can’t remember the command you just typed.

Cause: the result of burning 3 straight hours with no 50/10 — not a willpower problem but attentional-resource depletion.

Fix: if you’re already broken, turn off the screen for 10 minutes right now — 30 minutes worked with a broken brain makes no progress. From the next run, set the 50-minute timer the moment you start. And record it in the retrospective — the time you broke and the log density right after. Confirmed with your own data, rest gets accepted not as "goofing off" but as pace strategy.

Wall 2. I regret the fake entrance only after spending the whole budget on it

Symptom: at hour 5 you realize "it was a different path from the start."

Cause: there was no decision rule, or extension tokens were used back to back.

Fix: print the 2-2 rule on paper and stick it next to your monitor — a rule that depends on memory doesn’t work at hour 5. And in this run’s retrospective, write "the fake entrance’s early telltale signs" — Medium’s fake entrances usually send a signal in the first 15 minutes (strange silence of error messages, response inconsistencies). That sign list raises your discard speed on the next run.

Wall 3. Self-reports feel like a chore and I skip them from round 4

Symptom: the log is empty after 3:00.

Cause: the moment a self-report feels like "work," immersion always wins.

Fix: shrink the three boxes to one line — [4:00] ②foothold / trying candidate 2 / on track. One line is 30 seconds, and for 30 seconds even immersion yields. What matters is not the format’s polish but that there’s no empty stretch on the time axis. An empty time axis is the only defect that makes a retrospective impossible.

Wall 4. I used all 8 hours and only have a user shell — continue or stop?

Symptom: you think "stopping now would be a waste."

Cause: the collision of time-attack scoring and learning appetite — the long-game version of Step 276’s Wall 5.

Fix: fix the score at 8 hours (maximum progress: user shell), and separate everything after as study time under a different log. But one condition unique to the long game — don’t continue today. The "just a little more" of a brain that burned 8 hours usually ends as 2 progress-free hours. Tidy the save file (2-4), sleep, and resume tomorrow on a fresh log — it’s shorter in total time.

Wall 5. I sit down to write the retrospective and the 8 hours are one blur

Symptom: you have no memory of around noon at all.

Cause: self-reports and saves collapsed midway — memory keeps only the climax scenes (just before the shell) and erases the rest.

Fix: don’t give up on this run; write what can be reconstructed first — terminal history, the modification times of scan output files, browser history become the time axis’s skeleton. And there’s one lesson for the next run — in an 8-hour training run, records are not post-run work but hourly insurance.

7. Summary

Today’s Concepts

Concept	One-line explanation
Time budget	enum 2h / foothold 3.5h / privesc 2h / slack 0.5h — the Medium 8-hour map
Decision rule	Pre-set rule for continue vs. change on budget overrun — one extension token per path
Fake entrance	A path that looks vulnerable but blocks — 1–2 included in the Medium budget is normal
50/10 rhythm	50 min work / 10 min (screens-off) rest — focus is a cycle, not willpower
Mid-run save	Current state / verified facts / open hypotheses — 1 minute of insurance per hour
Hourly self-report	Current position / next action / off-track signal — the long game’s course-correction device

Today’s Tools & Formats

Tool/format	What it does
Budget table + lap-time log	Parallel recording of plan and measurement (reuse Step 276’s analyzer with new budgets)
Self-report three boxes	Records position, action, and derailment in 1 minute on the hour
Extension-token rule	Caps one path’s maximum loss at 2 budget units
Save three items	Keeps the run resumable no matter when it’s cut

An Instinct More Important Than Commands

What the 8-hour training teaches is not technique but the fact that self-management is part of skill. Hour-5 judgment is made by hour-0 schedule design, and hour-7 logs are protected by hour-3 rest. Your hands fight the machine, but your system fights the 8 hours.

And this long-game instinct becomes the stamina for the next stage — the real-world check that stacks a presentation on top of the time attack. Facing a match that doesn’t end with breaking in, you already have a long-distance runner’s heart.

Once every box is checked, Step 277 is complete.