Step 288. CTF Debrief Block A + Focused Weakness Work: A 10-Problem Boot Camp on the Type You Keep Missing — Chronic Ills Are Cut by Concentrated Repetition

Level 3 — The CTF Competition Cycle | Difficulty ★★★☆☆ | Estimated time: 3 days (3–4 problems of boot camp per day + cheat sheet + self-test)

Prerequisites: Step 280’s debrief block A procedure, Step 284’s weakness analysis, Step 285–287’s competition debrief records — five competitions’ "failure lists" must be accumulated.

What you need: debrief notes from competitions #1–#5 (lists of missed problems), platforms for picking problems by type (DreamHack dreamhack.io, webhacking.kr, pwnable.kr, etc.), a note for the boot-camp log. Platform solving scenes are screen examples.
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. The platforms used today are legal practice grounds officially opened by their operators for learning — never use the techniques outside the practice grounds.
This chapter is a training chapter — no new concepts; the whole thing is a design method for picking "the type you keep missing" and drilling it through 10 problems.

Overlay five competitions’ debrief data and a pattern appears. Zero points whenever a heap problem appears, SSTI missed every time, never even touched a crypto oracle problem — one failure is luck, but a failure repeated three times is a chronic illness. Let a chronic illness slide between competitions and you collapse at the same spot at the next competition too.

Today’s prescription is simple and rough — gather 10 problems of just that type and drill them over three days. What scattered "someday studying" can’t fix, continuous exposure to the same type fixes. But this training has one trap of its own — answer memorization. The devices for dodging that trap are part of today’s design.

1. Learning Objectives

By the end of this chapter, you will be able to:

Select the TOP failure-frequency types from debrief records using data
Collect 10 training problems in difficulty order using platforms’ per-type filters
Run a 3-day boot camp applying the "why couldn’t I solve this before" contrast to every problem
Design verification devices (self-test) that dodge the answer-memorization trap
Build a per-type cheat sheet (concept → tools → commands → traps) and a common-structure summary sentence

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	Platforms with per-type filters (DreamHack / webhacking.kr / pwnable.kr, etc.), Markdown (log & cheat sheet)
Today’s command	None — solving platform problems is the exercise. Review the tools of the boot-camp type
Concepts needed	Failure frequency, type boot camp, pattern recognition, the answer-memorization trap, self-testing
Today’s deliverable	Boot-camp log (10 problems) + type cheat sheet + common-structure summary sentence + self-test result

2-1. Why "Type" as the Unit — Failures Repeat by Type, Not by Problem

Scan your debrief notes and the failed problems bundle by type. CTF#1’s ssti-note, CTF#2’s ssrf-internal, CTF#3’s race-condition — the problems differed every time, but the root "server-side input handling" was the same. Review by problem and you become able to solve that one problem; train by type and you become able to solve the whole root’s problems.

Type selection is done with data. Classify five competitions’ failure lists by type tag and count frequencies, and the TOP picks itself. Not the gut "I think I’m weak at SSTI" — decide with "4 failures in server-side types, the most." Step 286’s tag statistics serve as material here too.

2-2. The Principle of Type Boot Camps — Pattern Recognition Arises from Continuous Exposure

Drill 10 problems of the same type over three days, and the first 2–3 are "study" — then something else starts happening. Around the fourth problem, while reading the problem statement, "ah, this is that type" surfaces first — that is pattern recognition. Individual knowledge (syntax, tools, commands) is learned in the first problems, but what a competition truly needs is "the eye that recognizes this problem as that type," and that eye arises only from continuous exposure.

So the boot camp’s completion condition is not "solved 10" — it is being able to summarize in one sentence the common structure running through the 10. If you can’t summarize, you solved ten problems but solved them ten separate times.

The time layout has a reason too. Spreading across three days is not schedule management but targeting the spacing effect — solve all 10 in one day and the brain processes them as "today’s procedure," but face them again across a night and the brain is forced into "recall of yesterday’s learning." Only when this recall happens does the pattern move from short-term to long-term memory. The boot camp’s three days aren’t a tight schedule — they’re a design that sandwiches time for memory to set.

2-3. The Answer-Memorization Trap — The Boot Camp’s Greatest Enemy

Solve the same type continuously and something odd starts happening midway. Instead of solving the problem, you start submitting a rearrangement of the previous problem’s answer. Points come out but no pattern recognition forms — this is the answer-memorization trap.

Signal	Normal training	Answer memorization
Starting	Reads the problem’s signals and judges the type	Already knows the type; replays the procedure
When stuck	Changes hypotheses	Fixes only the parts that differ from the last solution
After passing	Can explain why it worked	"Because it was similar to before"

Three prevention devices. ① Write each problem’s own signals in the write-up (a sentence that would be written identically for the previous problem is not a signal), ② sandwich other activities between problems (continuous immersion encourages memorization — a 30-minute gap between problems), ③ finish the boot camp by solving 1 fresh problem under a time limit (the self-test — memorization can’t solve a fresh problem).

All three devices come from the same principle — cutting the replay path. Signal recording blocks "solving without judging," inter-problem gaps block "afterimages of the previous answer," and the self-test blocks "solving from the list’s memory." For a boot camp to remain training, the problems must stay unfamiliar the whole way through.

2-4. Collecting and Arranging Problems — Difficulty as a Staircase

Don’t gather the 10 problems haphazardly. The arrangement has rules.

Collection rules:
- 10 problems of the same type, different variants (DreamHack type filter, webhacking.kr related problems, pwnable series)
- Difficulty layout: 3 easy / 5 medium / 2 hard — build success up front or the back won't open
- Exclude the very problems you missed at competitions — those belong to debrief block A (you've already seen the analysis, so memorization contamination)

The last rule matters. If you already know the answer to a problem you missed at a competition, it can’t serve as a boot-camp problem — it can’t verify pattern recognition. Handle that problem separately with the Step 280 procedure (digging to the bottom), and fill the boot camp with same-type problems you’ve never seen.

Some types have no good collection source — rare forensics variants, for instance, may not yield 10. Then fill with close cousin types — if only 3 "disk image timeline" problems exist, put "log timeline reconstruction" problems in the same slot. The boot camp’s purpose is not those ten problems but judgment power over the root, so mixing cousins is not contamination but generalization training.

3. Follow Along

3-1. Day 0 — Type Selection and Problem Collection

Spread the debrief notes and Step 286’s tag statistics, and count failure-type frequencies.

Screen example (failure-type tally):

Type classification of failed problems, competitions #1–#5:
- server-side (SSTI/SSRF/deserialization): 4 ← TOP 1
- heap exploitation: 3 ← TOP 2
- crypto oracle: 2
- other one-offs: 4
→ boot-camp target: server-side (TOP 1). Heap reserved for the next boot camp

Pick the TOP 1–2 — three or more at once dilutes the boot camp into scattered study. Record the unselected types as "reserved." Boot camps come around in cycles, so what’s not done now is not discarded but ordered.

Collect 10 same-type problems from the platforms and make a list — problem name, platform, expected difficulty, and order, all fixed in advance.

3-2. Days 1–3 — 3–4 Problems a Day, a "Contrast Sentence" for Every Problem

A day runs like this. A 60–90 minute cap per problem; fill five cells in the boot-camp log with every solve.

Screen example (boot-camp log, type = SSTI):

[problem 3/10] DreamHack ssti-basic-2 — 45 min, solved
- signals: the template engine's name (Jinja2) exposed on the error page
- contrast with past failure: at CTF#1's ssti-note I couldn't pin the engine and stalled at step 0
  → this time the procedure came right out: induce error → pin engine → decide payload
- newly learned: the {{7*7}} probe payload gets different responses per engine (Twig returns the formula as-is instead of 49)
- traps: variants exist that filter {{}} — {% %} syntax bypass appears at problem 7
- one-line summary candidate: "half of SSTI is pinning the engine"

The core cell is the second — "contrast with past failure." Lay the moment you couldn’t solve it at the competition next to today’s solve, and what got filled shows exactly. Solve 10 problems without this contrast and you can’t tell whether your skill rose or you knew it all along.

The time cap (60–90 minutes per problem) is also a rule. Without a cap, a trap appears where one problem eats all three days — a problem left unsolved at the cap is marked "unfinished" and you move on. Unfinished problems become debrief block A material, finished on the boot camp’s last day by reading write-ups. This cap is the device that keeps the boot camp’s rhythm — hammer away, but don’t get crushed under one problem.

3-3. Daily Wrap-up — Refining the Common-Structure Sentence

At each day’s end, try writing the common thread of that day’s problems in one sentence. Clumsy is fine — the point is refining it over three days.

The common-structure sentence growing (screen example):
day 1: "SSTI is code executing inside a template" → merely a definition, not an assault sentence
day 2: "induce an error to pin the engine, then go with per-engine payloads" → a procedure shows
day 3: "find where input lands in the template → pin the engine with probe payloads →
       bypass syntax if filters exist → converge on the read target (config/flag)" → a reusable procedure

Day 3’s sentence is the boot camp’s real deliverable. At the next competition, this sentence is the assault sequence that unfolds the same moment you judge "this problem is SSTI."

3-4. Writing the Cheat Sheet — Concept → Tools → Commands → Traps

When the boot camp ends, complete the type cheat sheet in Step 285’s 4-cell format. The material is the log’s ten problems, so this cheat sheet becomes not "a textbook summary" but "a compression of the ten rounds I went through."

Screen example (SSTI cheat sheet):

[SSTI cheat sheet] — compressed from 10 boot-camp problems
- concept: a vulnerability where user input executes as template-engine code
- signals: a form that re-renders input in the response + engine traces on error pages (Jinja2/Twig/Tornado)
- tools·commands: probes {{7*7}} / {{7*'7'}} → pin engine → tplmap or manual payloads
- traps: ① {{}} filter → {% %} bypass ② sandbox-removal bypass needs subclass traversal
       ③ there's no "engine that doesn't work," only "syntax you don't know" — open the engine docs first

3-5. The Self-Test — 1 Fresh Problem, Time-Limited

On the last day, solve 1 fresh same-type problem — one not in the boot-camp list — under a 60-minute limit. This is the verification device for the answer-memorization trap: if you "replayed" the 10 problems, you can’t solve a fresh one; if pattern recognition formed, you solve it or at least the assault procedure unfolds.

Score by procedure, not by the dichotomy. If the cheat sheet’s procedure — signal reading → engine pinning → payload → trap check — unfolded without stalls within 60 minutes, the boot camp succeeded even if time ran short of a solve. Conversely, if you wandered at the first step, half of the 10 problems was memorization — and you redo that half. Unfair as it feels, discovering it now is lucky. Far cheaper than discovering it at the next competition.

The best way to pick the self-test problem is asking a teammate — pick one yourself and you’ll unconsciously choose a confident variant. For a team boot camp, picking each other’s test problems is a gift you give each other.

4. Missions & Exercises

Mission — Finish the 10-Problem Boot Camp on Your Missed Type

Classify competitions #1–#5’s failure lists by type, count frequencies, and select the TOP 1–2 (record the rest as "reserved").
Collect 10 same-type problems from platforms — difficulty staircase (3 easy / 5 medium / 2 hard), excluding the very problems you missed at competitions.
Solve 3–4 problems a day over three days, filling the boot-camp log’s five cells (signals / contrast / new knowledge / traps / summary candidate) per problem.
Refine the common-structure sentence in each day’s wrap-up.
Complete the type cheat sheet’s 4 cells (concept / signals / tools·commands / traps).
Run a 60-minute self-test with 1 fresh problem off the list, and score by procedure.

Exercises

Exercise 1. Using the expression "root," explain the difference between problem-unit review and type-unit boot camp.

Exercise 2. Pick the signals for judging whether you’ve fallen into the answer-memorization trap from the 2-3 table, and explain each.

Exercise 3. Why is the very problem you missed at a competition excluded from the boot-camp list? How should that problem be handled?

Exercise 4. Why is the boot camp’s completion condition "summarizing the common structure in a sentence" rather than "finishing 10"?

5. Model Answers & Completion Criteria

Mission Model Answer

Check against these verification criteria.

Grounds for selection: is there a type-frequency tally table, and did the TOP selection come from that table — a type picked by gut can tilt the boot camp’s direction.
List rule compliance: is the difficulty staircase kept, and are the competition-failure problems themselves excluded?
The log’s core cell: do all ten problems have a "contrast with past failure" — a log with this cell empty is not a boot camp but just problem-solving.
Sentence growth: are there traces of the common-structure sentence refined from day 1 to day 3 — a sentence complete from the start means you already knew it before the boot camp, and that type was never a boot-camp target.
Self-test honesty: is the fresh problem’s procedure unfolding recorded, with a retraining decision made on failure?

Exercise Answers

Answer 1. Problem-unit review fixes that one problem, but a repeating failure comes from a root called the type, not the problem. Review ssti-note and you can solve ssti-note, but ssrf-internal is still a new problem. A type-unit boot camp trains the whole root of "server-side input handling," so whatever variant of that root appears at the next competition, judgment and assault work. A chronic illness heals only by treating the lesion (the type), not the symptom (the problem).

Answer 2. First, the start — if instead of reading the problem’s signals and judging the type you already know the type and begin replaying the procedure, that’s memorization. Second, the stuck response — if instead of changing hypotheses you fix only the parts differing from the previous solution, that’s not exploration but rearrangement. Third, after passing — if "why did it work" can’t be explained and "because it was similar to before" comes out, that’s not pattern recognition but memory of the answer. All three signals fail at competitions — a competition’s problems are always variants you’ve never seen.

Answer 3. Because that problem’s answer structure was already seen in the debrief, so it can’t verify pattern recognition — solving a problem whose answer you know is replay, not judgment. Handle that problem with Step 280’s debrief block A (digging to the bottom) — the place where you analyze why you couldn’t solve it and fill the needed knowledge. The boot camp works as a verification device only when run, after that analysis, on ten same-type problems you’ve never seen.

Answer 4. Because the boot camp’s purpose is not knowledge accumulation but pattern recognition. Solve ten problems separately and end, and only each problem’s knowledge remains; the competition-necessary "eye that recognizes this problem as that type" never forms. The common-structure sentence is evidence that ten rounds of experience compressed into one judgment procedure, and only with that sentence does a bridge span between the tenth problem and the eleventh (the competition’s new variant). What you can’t write as a sentence hasn’t attached to your body yet.

Completion Criteria Checklist

[ ] I tallied competitions #1–#5’s failure lists by type frequency
[ ] I selected the boot-camp type TOP 1–2 with data (rest recorded as reserved)
[ ] I collected 10 same-type problems on a difficulty staircase (3/5/2)
[ ] I excluded the competition-failure problems themselves from the list
[ ] I solved 3–4 problems a day over three days and filled the log’s five cells
[ ] I refined the common-structure sentence over 3 days
[ ] I completed the type cheat sheet’s 4 cells
[ ] I ran the 60-minute self-test with 1 fresh problem and scored by procedure

6. Common Pitfalls & Fixes

Wall 1. I gathered 10 problems and half turned out to be a different type

Symptom: midway through, a problem I thought was SSTI was template-free command injection.

Cause: you classified by problem statements at collection — platforms’ type tags are rough, so boundary problems slip in mixed.

Fix: don’t discard them; mark them "type departure" in the log and keep solving — departure problems are precious material. Once you can write in a sentence "why is this problem not SSTI," you know the type’s boundary, and judgment that knows the boundary doesn’t wobble at a competition’s variants. The goal is not "a pure 10" but "judgment power."

Wall 2. From the 4th problem it got too easy and I got bored

Symptom: the staircase’s easy problems start solving similarly, and it’s tedious.

Cause: a normal signal that pattern recognition is forming — the boredom itself is evidence of growth. Though this is also exactly where the answer-memorization trap begins.

Fix: from the moment boredom sets in, halve the time limit on each problem. The easy stretch’s remaining value is speed — a team that processes Easy in 15 minutes and one that takes 60 get different Hard-challenge time at competitions. And keep the inter-problem gaps (2-3’s ②) so it stays judgment practice, not memorized replay.

Wall 3. I got completely stuck on the 2 hard problems and the boot camp broke

Symptom: couldn’t solve problems 9–10, so it feels like "boot camp failed."

Cause: the staircase’s top is a place you may legitimately fail to cross. The 2 hard ones were put in for measurement, not training.

Fix: record the reach point (Step 287’s document format) and hand it to a write-up or debrief note. The boot camp’s success is judged by the easy-and-medium 8’s procedure unfolding and the common-structure sentence. The top wall gets reserved under the name "next boot camp’s pre-study list" — the coordinates of a wall not crossed this time, recorded exactly, are also harvest.

Wall 4. The cheat sheet became a copy of the boot-camp log

Symptom: the cheat sheet’s "traps" cell has per-problem episodes in ten lines — too much to read at a competition.

Cause: you skipped compression. The log is ten rounds of records; the cheat sheet is their crystallization — they must not be moved over in the same form.

Fix: test each cheat-sheet cell with "is it readable within 60 seconds?" For any cell that overflows, ask — "does this sentence change a decision mid-competition?" Sentences that don’t stay in the log and are deleted from the cheat sheet. The deletion criterion is the same as Step 278’s "the audience’s three things" — this time the audience is your mid-competition self.

Wall 5. The procedure didn’t come out in the self-test — the boot camp feels wasted

Symptom: in front of a fresh problem, you wandered from engine pinning on. After solving 10 problems.

Cause: a good chance a significant share of the 10 passed by answer memorization — painful, but the self-test did its job.

Fix: re-diagnose instead of despairing. Scan the boot-camp log, mark memorization suspects with the three signals (2-3), and re-solve only those under changed conditions — different day, different order, without looking at the log. Procedures attaching to the body inherently need repetition. Discovering that half of your first boot camp was memorization is not failure — it’s the exact blueprint of your second boot camp.

7. Summary

Today’s Concepts

Concept	One-line explanation
Failure-frequency tally	The procedure of bundling five competitions’ failures by type and fixing the TOP with data
Type boot camp	Concentrated repetition drilling 10 same-type problems over three days — how pattern recognition is manufactured
Pattern recognition	The state where "this is that type" surfaces before the solve — the product of continuous exposure
Answer-memorization trap	The state of rearranging and submitting the previous solution — points come out but no eye forms
Common-structure sentence	One sentence running through 10 problems — the boot camp’s real completion condition
Self-test	1 fresh off-list problem, time-limited — the device verifying whether it was memorization

Today’s Tools & Formats

Tool/format	What it does
Failure-type tally table	The ruler that pulls boot-camp targets out of debrief notes
Difficulty staircase (3/5/2)	Arrangement that stacks success up front to cross the walls behind
Boot-camp log 5 cells	Signals / contrast / new knowledge / traps / summary candidate — each problem’s compression
Cheat sheet 4 cells	The boot camp’s crystallization — sized to read in 60 seconds mid-competition
Self-test scoring	Procedure-unfolding standard — scored by process, not the dichotomy

The Instinct Beyond Commands

A chronic illness’s terror is not the repetition itself but greeting the next competition on the expectation "this time will be different." The boot camp is the procedure that cuts that expectation — fix the type with data, drill ten times, compress into a sentence, verify with a fresh problem. A type you’ve turned this cycle on once greets you first the moment you open its problem at the next competition — "I’m that type, you know."

And the boot camp’s byproducts remain with the team. The cheat sheet you refined becomes a team asset (Step 285), and the self-test’s procedure scoring makes the next competition’s depth-of-reach records exact. One person’s chronic-illness treatment connecting to the team’s armory maintenance — that is the competition cycle’s compound interest.

Once every box is checked, Step 288 is complete.