Step 289. ★ CTF #6: The Midterm Evaluation Competition — Aiming for the Top 50%, the Team That Reads the Scoring Structure Harvests the Points
Level 3 — The CTF Competition Cycle | Difficulty ★★★☆☆ | Estimated time: 2 days (competition participation + half a day of analysis)
Prerequisites: competitions #3–#5 and the debrief–drill cycle of Steps 279–288 complete, Python 3 (for the scoreboard analyzer).
- What you need: one CTF competition for your team to enter, the team’s shared documents (cheat sheets, debrief records), a timer, and Python 3. The competition scenes in this chapter are screen examples; the scoreboard analyzer runs are marked as measured (2026-09-09, Python 3.12).
- ⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime.
- This is an evaluation chapter — not new techniques, but a day of measuring whether everything you’ve trained so far converts into points.
The sixth competition is your report card. Since Step 279 you’ve fought five competitions, debriefed every one, and patched weak problem types with drills. Today’s competition is the midterm settlement that checks whether that cycle converts into real-world points.
The goal is the top 50%. What that number means is "graduating from Beginner" — half the teams in a competition spend the whole event solving one or two problems at most, holding their seats until the end. Clearing that half decisively is an objective signal that your team’s routine has achieved a minimum real-world operating system.
And to aim for the top 50%, you first need to know how points are awarded. Some competitions score the same problem differently depending on when you solve it and how many teams have solved it. Let’s take that structure apart first.
1. Learning Objectives
By the end of this chapter, you will be able to:
- Explain the difference between static scoring and dynamic scoring, and what each means for solving strategy
- Compute your team’s rank, top percentile, and distance to the cutoff line from scoreboard data
- Apply the three-stage operating order to a competition: "secure base points → mandatory points from drilled types → Hard attempts"
- Check your rank at the competition’s halfway point and adjust the remaining time allocation
- Measure absolute growth with a comparison report against your first competition half a year ago
2. Background Knowledge — Today’s Tools and Concepts
Today’s Tools at a Glance
| Category | Details |
|---|---|
| Language/environment | CTF competition platform (CTFd-style), team shared documents, Python 3 (analyzer) |
| Today’s command | python step289_scoreboard.py — rank and cutoff-line calculation |
| Concepts needed | Dynamic scoring, top percentile, field coverage, the midway check |
| Today’s deliverable | Final rank record + per-field score table + half-year comparison report |
2-1. How Points Are Computed — Point Values May Not Be Fixed
CTF scoring comes in two broad flavors.
Static scoring fixes a point value per problem, identical no matter who solves it or when. A 100-point problem is 100 points on the first solve and on the last.
Dynamic scoring lowers the point value as more teams solve. The CTFd platform’s default formula looks roughly like this — with maximum 500, minimum 100, and decay 15, we actually computed the value at different solve counts.
Measured (2026-09-09, Python 3.12 — part of the 3-2 script’s output):
=== Dynamic scoring: point decay by solve count ===
solves 0 teams → value 500
solves 1 team → value 499
solves 3 teams → value 484
solves 5 teams → value 456
solves 10 teams → value 323
solves 15 teams → value 100
solves 20 teams → value 100
How to read it: the value falls slowly at first, plunges past 10 teams, and hits the floor around 15 teams. The strategic meaning is clear — an easy problem many teams will solve is worth more the earlier you solve it. Conversely, a problem nobody can solve keeps its high value to the end. Your usual "easy first" routine is also a scoring strategy in dynamic competitions.
2-2. What the Top 50% Means — The Cutoff Is a Rank, Not a Score
"Top 50%" is not a score goal but a rank goal. With 40 teams the cutoff is 20th place; with 200 teams it’s 100th. So what you must check mid-competition is not your score but your rank and the score gap to the cutoff-line team.
Knowing the distribution matters too. A CTF scoreboard usually has a top few teams sweeping up points, a densely packed middle, and a bottom half clumped at low scores. In this structure, in the midfield one problem is five ranks. It’s common for 20th and 25th place to be separated by 50 points.
2-3. What the Midterm Measures — The Cycle’s Conversion Rate
This competition measures three things.
| What’s measured | How to check | Expected signal |
|---|---|---|
| The debrief routine’s effect | Whether the same types failed again versus last time | Failed types don’t repeat |
| The drill’s conversion | Scoring on problems of the drilled weak types | 1+ drilled-type problem solved |
| Operational stability | Consistency of time allocation and problem selection | All base points (easy problems) secured |
Rank is just the sum of these three. If the rank falls short but you know which of the three collapsed, that is the next cycle’s assignment. Conversely, if you hit the rank but the three were a mess — you got lucky, and it collapses at the next competition.
2-4. The Three-Stage Operating Order — Points Are Stacked from the Top
Fix the midterm competition’s operating order like this.
- Secure base points — sweep the lowest-value problem in every field first. Missing an easy problem is not a skill issue; it’s an operational accident.
- Mandatory points from drilled types — if a problem of the type you drilled in Step 288 appears, take it without fail. This is where the drill’s conversion rate gets measured.
- Hard attempts — after the first two are secured, spend only half of the remaining time on Hard. The other half goes to finishing half-solved problems and double-checking.
There’s one typical pattern that breaks this order — clinging to a Hard problem early in the competition and delaying the base-point harvest. You pass the midterm not with a flashy single blow but with a harvest with nothing missing.
3. Follow Along
3-1. Pre-Checks — Share the Cheat Sheets and Debrief Records
The day before the competition, post two things to the team’s shared document.
Sharing checklist (the day before):
[ ] Step 288's drilled-type cheat sheet — one page in concept → tool → command → pitfall order
[ ] Summary of the last 5 competitions' debrief records — "our TOP 3 recurring mistakes"
[ ] Competition timetable — start/midway check/end times, lunch window
[ ] Role confirmation — who is first responder for which field (rotation experiments come next competition)
Why: a document you have to search for mid-competition is the same as not having it. There’s no time to search mid-competition, and even when there is, it breaks your focus. One hour of preparation the day before saves 30 minutes many times over on competition day.
3-2. The Scoreboard Analyzer — Reading the Rank in Numbers
Build the analyzer you’ll use for the midway check and after the end, in advance. Save the code below as step289_scoreboard.py.
# CTF scoreboard analyzer — compute rank and top percentile
import math
def dynamic_value(maximum=500, minimum=100, decay=15, solves=0):
"""CTFd-style dynamic scoring: value drops as solves increase"""
if solves == 0:
return maximum
value = (((minimum - maximum) / (decay ** 2)) * (solves ** 2)) + maximum
return math.ceil(max(value, minimum))
teams = { # data copied from the scoreboard — replace with your actual competition's
"alpha": 4310, "bravo": 3980, # ... (snip) ...
"our-team": 1820, "uniform": 1750, # ... 40 teams total ...
}
def report(scoreboard, my_team):
ranked = sorted(scoreboard.items(), key=lambda kv: kv[1], reverse=True)
n = len(ranked)
rank = next(i for i, (name, _) in enumerate(ranked, 1) if name == my_team)
print(f"Teams entered: {n}")
print(f"Rank: {rank} / {n} → top {rank / n * 100:.1f}%")
cutoff = math.ceil(n / 2)
median_score = ranked[cutoff - 1][1]
print(f"Top-50% cutoff: rank {cutoff} (score {median_score})")
gap = median_score - scoreboard[my_team]
print(f"Points short of the cutoff: {gap}" if gap > 0
else f"Cutoff cleared: +{-gap} points of margin")
Run it with python step289_scoreboard.py.
Measured (2026-09-09, Python 3.12 — 40-team example data):
Teams entered: 40
Our score: 1820
Rank: 21 / 40 → top 52.5%
Top-50% cutoff: rank 20 (score 1870)
Points short of the cutoff: 50
How to read it: this example’s team narrowly lands at 21st — top 52.5%, 50 points short of the cutoff. This is exactly the "in the midfield one problem is five ranks" scene from 2-2. If they grab even one 100-point misc problem in the remaining time, they pass — this calculation has to come out at the midway check for the last two hours’ direction to be set.
3-3. Running the Competition — Executing the Three-Stage Order
When the competition starts, the first 30 minutes are the full sweep. Write every problem’s title, points, field, and solve count into a table. Then move by 2-4’s order.
Screen example (the operations table at the midway check):
=== Competition midway check (12 of 24 hours elapsed) ===
Now: rank 21 / 40 teams, 1820 points
Cutoff (rank 20): 1870 points — 50 short
[Secured] web 3, crypto 2, rev 2, pwn 1 = all base points complete
[In progress] drilled-type problem (web SQLi) — member A, 70% along
[Untouched] misc 2 problems (100 each) — nobody has looked
[Dropped] Hard pwn (500) — 0 solves, beyond our reach
Adjustment: finish the drilled problem, then take 100 from the 2 misc → clears the cutoff
Hard gets only whatever time remains after that
How to read it: the midway check’s output is not impressions but an adjustment decision. The remaining time’s allocation has to come out as a sentence, like "misc untouched → 100 points available → assign."
3-4. Right After the End — Record the Per-Field Score Table
When it ends, record while memory is alive. The analyzer’s field-table feature makes it fast.
Measured (2026-09-09 — run on example data):
field | solved/posed | points
---------|--------------|-------
web | 3/5 | 600
crypto | 2/4 | 550
pwn | 1/4 | 300
rev | 2/4 | 370
forensic | 0/3 | 0
misc | 0/2 | 0
Total points: 1820
Field coverage: 4/6 fields
How to read it: look at the zero-point fields before the scores. forensic and misc are 0 — if both were posed and never touched, that’s a time-operations problem; if they were attempted and unsolved, it’s a capability problem. That distinction decides the next drill topic.
3-5. The Half-Year Comparison Report — See Growth, Not Rank
The final deliverable. Set it side by side with the records of your first competition (Step 279).
=== Half-year comparison report (template) ===
1st comp 6th comp Change
Score 320 1820 +1500
Rank 58/70 (lower) 21/40 (top 52.5%) entered the upper half
Problems solved 2 8 4x
Field coverage 1/6 4/6 +3 fields
Repeat failure types SQLi, heap (resolved) drill effect confirmed
One-line settlement: (e.g.) "The debrief-drill cycle has started converting
into points. Next assignment: open up the zero-point field (forensic)"
Why: rank wobbles because the participating level differs from competition to competition. Even if you missed the top 50% this time, if score, problem count, and coverage all trend upward, the cycle is operating normally. The real metric is "our absolute growth versus last time."
4. Missions & Exercises
Mission — Finish the Midterm Competition and Write the Comparison Report
- Pick a competition for the team to enter, and post the cheat sheets, debrief summary, and timetable to the shared document the day before.
- Build 3-2’s analyzer for your team’s environment — including how you’ll copy the scoreboard (manual copy or periodic captures).
- Run the competition with 2-4’s three-stage order. Do a midway check at the halfway point and leave the adjustment decision as a sentence.
- After the end, record the per-field score table and classify the cause of each zero-point field (time vs. capability).
- Write the comparison report against your first competition — the four metrics (score/rank/problem count/coverage) are mandatory.
- Record whether you entered the top 50% — if not, substitute a cause analysis of which of the three measured items (2-3) collapsed.
Exercises
Exercise 1. From the standpoint of the point-decay curve, explain why "solving easy problems fast" is a scoring strategy in a dynamic-scoring competition.
Exercise 2. The two numbers to check at the midway check are said to be a different pair than "our score" and "our rank." What is the pair, and why must it be that combination?
Exercise 3. Suppose there was a competition where only one of the three things the midterm measures (debrief effect, drill conversion, operational stability) collapsed — a drilled-type problem was posed but not solved. What should the next cycle’s assignment be?
Exercise 4. The source’s point — "don’t ride the emotional roller coaster of rank; the real metric is absolute growth versus last time" — is meant to prevent what trap? If you evaluate the cycle by rank alone, what misjudgments arise?
5. Model Answers & Completion Criteria
Mission Model Answer
Verify against these criteria.
- Traces of pre-sharing: are the cheat sheets and debrief summary posted to the shared document with a timestamp before the competition start — a document written mid-competition is not a pre-check.
- The midway check’s output: is an adjustment decision left as a sentence, like "misc untouched → assigned"? Capturing only the rank without a decision is spectating, not checking.
- Adherence to the three-stage order: were base points (all lowest-value problems) processed before Hard attempts — verify by the log’s time order.
- The score table’s completeness: is there a table of per-field solved/posed/points and coverage, with the cause classification of zero-point fields?
- The comparison report: are the four metrics side by side with the first competition, and does the "one-line settlement" point to the next assignment?
- Goal verdict: top-50% entry or a cause-analysis document — one of the two must exist. "It was a shame" is not a cause analysis.
Exercise Answers
Answer 1. Because point values drop as solve counts rise, the later you solve a problem many teams will solve, the more you lose. In 3-2’s measurement, a 500-point problem becomes 323 points at 10 teams and 100 at 15. Easy problems will be solved by every team — their decay is certain, so the earlier you solve them the higher the value they lock in at. Hard problems, by contrast, keep their high value to the end because solve counts don’t grow — there’s no reason to hurry.
Answer 2. "Our rank" and "the cutoff-line team’s score." Since the top 50% is a rank goal, not a score goal, the score’s absolute value means nothing and the distance to the cutoff means everything. Whether you’re 50 short or 50 ahead splits the remaining time’s allocation — if short, you scrape even low-value problems; if ahead, you can bet on Hard.
Answer 3. The drill’s conversion collapsed, so the assignment is re-examining the drill’s method. Possible causes: ① the 10 drilled problems missed the competition’s posing tendencies (a problem-collection problem), ② you could have solved it but lost out on time allocation (an operations problem), ③ the drill stayed at pattern memorization and broke on a variant (a depth problem). If it’s ③, design the next drill toward thickening the "concept" column of the cheat sheet.
Answer 4. It prevents being swayed by exogenous variables — the participating level differs per competition, so rank shakes. A dropped rank at a competition full of strong teams may not be skill regression, and a rise at a weak-team competition may not be growth. Watching rank alone produces the misjudgment of discarding a normally operating cycle or keeping a broken one. Only with the absolute comparison of score, problem count, and coverage does the verdict stop wobbling.
Completion Criteria Checklist
- [ ] I shared the cheat sheets, debrief summary, and timetable with the team the day before the competition
- [ ] I can compute rank, top percentile, and cutoff distance with the scoreboard analyzer
- [ ] I applied the three-stage operating order (base points → drilled types → Hard)
- [ ] I left the midway check and adjustment decision as sentences at the halfway point
- [ ] I recorded the per-field score table and the cause classification of zero-point fields
- [ ] I wrote the four-metric comparison report against the first competition
- [ ] I recorded whether the top 50% was reached (with cause analysis if missed)
6. Common Pitfalls & Fixes
Wall 1. I can’t resist the urge to grab a Hard problem early in the competition
Symptom: you want that 500-point problem so badly that the easy-problem harvest runs late.
Cause: solving Hard feels hugely rewarding, and there’s an illusion that easy problems "can be solved anytime."
Fix: in dynamic scoring, that illusion is itself a loss — the easy problems’ values fall while you wait. And there’s a rule that Hard gets only half of the remaining time, so defer the greed to stage 3. Keeping the order is a skill.
Wall 2. I did the midway check but no decision came out
Symptom: it ends at "we’re 21st right now." Operations afterward are unchanged.
Cause: with no check format, the check ended as impressions.
Fix: fix 3-3’s table as your format — current rank, distance to the cutoff, the untouched-problem list, and always one sentence on the last line starting with "Adjustment:". If the adjustment sentence won’t write itself, information is lacking — sweep the untouched problems again.
Wall 3. The scoreboard is live and I can’t focus
Symptom: you keep refreshing rank changes and can’t concentrate on problems.
Cause: without fixed check times, you watch the scoreboard infinitely.
Fix: fix your check times in advance — three times is enough: 2 hours after start, the midway check, and 2 hours before the end. In between, close the scoreboard tab. Your score rises when you solve problems, not when you watch the scoreboard.
Wall 4. We missed the top 50% by 50 points and team morale sank
Symptom: someone says "half a year and this is all?"
Cause: you judged half a year by a single rank.
Fix: open 3-5’s comparison report. If score, problem count, and coverage all trended upward, the cycle is normal, and the 50 points is the price of one operational accident like "misc untouched." It’s recoverable at the next competition. Conversely, if the metrics are flat — then it’s not the rank but the cycle that needs surgery. Either way, the table judges, not emotion.
Wall 5. I built the analyzer but don’t know how to copy the scoreboard
Symptom: you’re stuck on how to move the platform screen into data.
Cause: every competition platform has a different format, and many don’t expose an API.
Fix: manual is the right answer — moving just the five teams near the cutoff plus your team’s scores by hand is enough for the midway-check math. If you need the full ranking, copy the entire scoreboard page and tidy it into "team: score" form in a text editor. Elegant automated collection is a hobby for after the competition, not a necessity during it.
7. Summary
Today’s Concepts
| Concept | One-line explanation |
|---|---|
| Dynamic scoring | Value drops as solves rise — easy problems are worth more the sooner you solve them |
| Top 50% | Not a score goal but a rank goal — operate by the distance to the cutoff |
| Three-stage operating order | All base points → drilled types mandatory → Hard (half of remaining time) |
| Midway check | Not a rank check but an event for making adjustment decisions |
| Field coverage | The presence of zero-point fields exposes time operations and capability gaps |
| Absolute growth | Rank wobbles per competition — the four metrics versus last time are the real report card |
Today’s Tools & Templates
| Tool/template | What it does |
|---|---|
| Scoreboard analyzer | Instant calculation of rank, top percentile, cutoff distance |
| Pre-sharing checklist | The day-before hour that eliminates mid-competition searching |
| Midway-check operations table | A format that turns impressions into "Adjustment:" sentences |
| Per-field score table | A table classifying zero-point fields’ causes (time/capability) |
| Half-year comparison report | A document judging the cycle by growth, not rank |
The Core Instinct
The midterm’s real deliverable is not the rank but judgment ability. A team that can compute "50 points to the cutoff" by itself mid-competition knows its next move whether it wins or loses. A team without that calculation learns the result only after the competition ends — when nothing can be changed anymore.
And remember — the top 50% is not a destination but a diploma. It’s only a signal that you’ve left the Beginner section; the cycle itself keeps turning. The next two steps (the debrief and the library tidy-up) are the process of converting this competition’s points into assets.
Once every box is checked, Step 289 is complete.