Step 293. ★ CTF #8: The Team Tactics Experiment — Role Rotation, Trading Points for a Map of the Team

Level 3 — The CTF Competition Cycle | Difficulty ★★★☆☆ | Estimated time: 2 days (competition participation + half a day of tactics comparison and retrospective)

Prerequisites: the competition operations experience of Steps 289–291, a small team (2–5 people) able to reach consensus, Python 3 (for the tactics comparison calculator).

What you need: one CTF competition for your team to enter, unanimous prior agreement of all members, the last competition’s per-field score records, Python 3. The competition scenes in this chapter are screen examples; the tactics comparison calculator runs are marked as measured (2026-09-09, Python 3.12).
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime.
This is an experiment chapter — this competition is not a scoreboard but a data-collection device.

At the eighth competition, we deliberately throw points away. The usual division of labor — the web person does only web, the pwn person does only pwn — maximizes scoring efficiency, but it keeps one thing forever unknown: where the team’s weak link is. If the web person goes down (graduation, a new job, a simple absence), does that field die that day? If nobody can answer, that is the answer.

Today’s experiment is simple. Everyone takes a non-main field for one competition, and we compare the result against the data from the usual division of labor. The short-term score drop is a planned cost — what that cost buys is three things: ① a feel for secondary fields ② mutual understanding among members ③ the coordinates of weak links.

1. Learning Objectives

By the end of this chapter, you will be able to:

Fix the prior agreements of a role-rotation experiment (purpose, assignments, rules) in a document
Measure "up to which problem types you can go alone" in a non-main field
Record the "consulting request" procedure to the main-field owner and the knowledge-transfer time
Compare scores and learning effects against fixed division of labor with a table and calculator
Decide the team’s final tactics (the fixed + flexible ratio) from experiment data

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	CTF competition platform, team shared documents, Python 3 (tactics comparison calculator)
Today’s command	`python step293_tactics.py` — fixed vs. rotation comparison calculation
Concepts needed	Role rotation, weak links (single-responder fields), consulting costs, the tactics ratio
Today’s deliverable	Tactics comparison data + a weak-link map + the final tactics document

2-1. Why an Experiment — The Shadow of Division of Labor

Fixed division of labor is legitimate. Depth comes from repetition, and competition points come from depth. But once the division hardens for half a year, shadows appear.

Shadow	Symptom	Danger
Single responder	One owner per field	That field dies when the owner is absent
Black-boxing	"Minsu handles web anyway"	Other members can’t even read those problems
Frozen strengths	Always the same fields	Lost chances to discover secondary talents

The rotation experiment is a competition that exposes these shadows. Fixing them is the next stage; today the goal is marking the coordinates. Dropping points is not a defect — it’s within the normal range of measurement.

2-2. Prior Agreement — "This One Is for Learning," in a Document

The source’s warning is the core — since a score drop is normal in an experiment competition, every member must agree "this one is for learning" before starting or resentment follows. Verbal agreement wobbles mid-competition. Leave it in a document.

Role-rotation experiment agreement (template):
1. Purpose: not points but team-tactics data collection. A score drop is a planned cost.
2. Assignments: (e.g.) Minsu→rev, Jiyeon→web, Hyeonu→pwn, Sujin→crypto
   — each person's non-main field. Interest-first assignment.
3. Rules:
   - Cheat sheets, the library, and the team write-up TOP 5 are free to use (same conditions as solving alone)
   - When stuck, send a 'consulting' request to the main-field owner — 10-minute timebox, no screen sharing (explanation only)
   - Record consulting time received and its content
4. Forbidden: mid-competition "should I just do it myself" — consulting is explaining, not solving for them

If item 4 collapses, the experiment collapses. The moment a frustrated main-field owner puts hands on the keyboard, the data on "up to which types can they go alone" is contaminated.

2-3. Consulting — Measuring the Cost of Knowledge Transfer

A problem you’re stuck on mid-rotation goes to the main-field owner. What makes this request different from the usual "help me" is the form.

Consulting request form:
Problem: (name/field)
Current state: how far you got and what isn't working (2 sentences)
What I tried: list of discarded hypotheses (if blank, the request is not allowed — you haven't tried alone yet)
Question: what should I check next? (you're asking for direction, not the solution)

Consulting time is a cost to both sides — 10 minutes of the receiver and 10 minutes of the teacher. Sum this time after the end and you get the knowledge-transfer cost — the "price tag of a field vacancy." It’s also an estimate of what the team would pay at a competition where the single owner is missing.

2-4. The Tactics Ratio — The Experiment’s Destination

The experiment’s end is not the dichotomy "fixed is better / rotation is better." It’s deciding a ratio. Run fixed division of labor normally to maximize points, but how often do you slot in a rotation, and does each member grow one secondary field into a "second responder"? Decide it with data.

What this judgment needs is two tables — the score comparison table (the cost) and the weak-link map (the harvest). We build them with the calculator in 3-4.

3. Follow Along

3-1. Beforehand — Writing the Agreement and Assigning

Three days before the competition, write 2-2’s agreement into the team document and get everyone’s confirmation. The assignment principles are two.

Among non-main fields, the one of interest — an unmotivated assignment is not an experiment but torture.
Prefer high-contrast pairings — combinations with different toolsets, like web↔reversing, yield bigger learning.

Once assignments are set, each person packs their gear — that field’s cheat sheet (Step 288), library templates (Step 290), and the team write-up TOP 5 (Step 292). Rotation is not bare-knuckle fighting. The accurate measurement is how far you can go alone while using the team’s usual assets.

3-2. During the Competition — Records Are the Experiment Equipment

Running the competition itself is the same as usual. What differs is the recording.

Screen example (per-person record card):

[Minsu — assigned rev (main: web)]
14:00 Opened crackme1. Read the TOP 5 'rev_crackme_xor' write-up first (15 min)
14:30 Progressed independently to XOR key extraction — solo-capable up to the "find the string-compare section" type
15:10 Stalled at the obfuscation section. Consulting request → 10 min from Sujin (direction: switch to dynamic analysis)
15:40 Solved. Record: independent reach = up to static analysis stage / consulting 10 min

Measurement memo: "Solo-capable: simple patching, string extraction / Not capable: obfuscation bypass"

How to read it: the last line is this experiment’s currency. Not "couldn’t solve it" but marking the boundary line of "how far I can go alone." Gather these boundary lines and the team’s per-field depth map is complete.

3-3. Right After the End — Summing the Consulting Log

When it ends, the team gathers and merges the consulting logs. Who asked whom, for how many minutes, about what.

Screen example (consulting log):

=== Consulting log (competition #8) ===
Minsu (rev) → Sujin: 10 min — direction to switch to dynamic analysis
Jiyeon (web) → Minsu: 12 min — verifying 2 auth-bypass hypotheses
Hyeonu (pwn) → Jiyeon: 20 min × 2 sessions — explaining the heap layout concept itself
Sujin (crypto) → Hyeonu: 8 min — correcting a misread of the problem
Total: 70 min (requester side) + 70 min (answerer side) = 140 min consumed

How to read it: Hyeonu’s 40 minutes of "explaining the heap layout concept itself" is the most expensive log — it means direction-pointing wasn’t enough and concept education was needed, i.e., the pwn field has the largest knowledge-transfer cost. It’s weak-link candidate number one.

3-4. The Tactics Comparison Calculator — Cost Versus Harvest

Feed the data for fixed division (previous competitions) and rotation (this competition) into the calculator. Below is the output of the step293_tactics.py we actually wrote and ran — the data is an example; replace it with your competition records.

Measured (2026-09-09 — python step293_tactics.py, example data):

=== Tactics comparison (example data) ===
[Fixed division] solved 11 / scored 2600
  Minsu (web)      solved 4  scored  900
  Jiyeon (pwn)     solved 3  scored  700
  Hyeonu (crypto)  solved 2  scored  550
  Sujin (rev)      solved 2  scored  450
[Role rotation] solved 5 / scored 1100
  Minsu (rev)      solved 1  scored  200
  Jiyeon (web)     solved 2  scored  400
  Hyeonu (pwn)     solved 0  scored    0
  Sujin (crypto)   solved 2  scored  500

Score change: 2600 → 1100 (-1500 points, 42%)
Consulting consumed during rotation: 115 min total — knowledge-transfer cost

[Weak links — single-responder fields]
  web     : Minsu   ⚠ 1 owner
  pwn     : Jiyeon  ⚠ 1 owner
  crypto  : Hyeonu  ⚠ 1 owner
  rev     : Sujin   ⚠ 1 owner

Verdict example: score dropped (normal) — in exchange, gained a feel for secondary fields and weak-link coordinates

How to read it: score down to 42% — the planned cost. What deserves attention is not the drop but the distribution. Sujin (crypto) produced 500 points even in a non-main field, while Hyeonu (pwn) scored 0 — same rotation, different results. What this difference says is "Sujin has a secondary talent for crypto, and pwn is a field where the whole team depends absolutely on Jiyeon alone." That sentence is exactly what 1500 points bought.

3-5. The Final Tactics Document — Fixing the Ratio

Document the team tactics from the experiment data.

=== Team tactics v2 (template + example) ===
1. Base tactic: keep fixed division of labor (scoring efficiency confirmed 2.4x superior)
2. Rotation cycle: 1 in every 4 competitions (experiment cost 1500 points → once a quarter is affordable)
3. Second-responder designations (weak-link response):
   - pwn: Jiyeon (primary) + Hyeonu (secondary) — Hyeonu's heap-concept drill is the top-priority assignment
   - crypto: Hyeonu (primary) + Sujin (secondary) — Sujin's secondary talent confirmed, partly for encouragement
4. Make the consulting rules permanent: apply the request form and 10-minute timebox at regular competitions too
5. Next experiment date: (date) — re-measure whether the pwn consulting cost has shrunk by then

Item 5 keeps this document alive. An experiment doesn’t end after one run — only by re-measuring the same metrics at the next experiment can you say "it improved."

4. Missions & Exercises

Mission — Finish the Role-Rotation Experiment and Fix the Tactics

Three days before the competition, write 2-2’s agreement as a team document and get everyone’s confirmation.
Each person prepares the cheat sheets, write-up TOP 5, and library for their assigned non-main field.
During the competition, fill your personal record card (3-2) — the "solo-capable boundary" sentence is mandatory.
Make consulting requests by the form, and record the time on both sides.
After the end, feed the team’s data into the tactics comparison calculator to extract the comparison table and weak-link map.
Write the final tactics document (3-5) — it’s complete only when the next experiment date is fixed.

Exercises

Exercise 1. Why does the rotation experiment assign "non-main fields of interest," and what difference does that make compared to random assignment?

Exercise 2. The consulting request form makes the request itself impossible when "what I tried (discarded-hypothesis list)" is blank. What is this rule’s purpose?

Exercise 3. In 3-4’s measurement, what two facts did the difference between Sujin (non-main crypto, 500 points) and Hyeonu (non-main pwn, 0 points) tell the team?

Exercise 4. Why must the final tactics document always fix a "next experiment date"?

5. Model Answers & Completion Criteria

Mission Model Answer

Verify against these criteria.

Documented agreement: is there an agreement dated before the competition start, with traces of everyone’s confirmation (comments, signatures)?
Forbidden-rule compliance: are there no cases of a main-field owner solving for someone mid-competition — if there were, is that problem’s data marked as contaminated?
Boundary sentences: does each person’s record card state "solo-capable / not capable" — "couldn’t solve it" is not experiment data.
Quantified comparison: are the score ratio versus fixed division and the total consulting time present as numbers?
Actionable tactics: does the final tactics document contain the rotation cycle, second responders, and next experiment date — vague sentences like "let’s be flexible going forward" don’t count.

Exercise Answers

Answer 1. Because the experiment is expensive, so harvest quality matters, and motivation is the biggest variable in learning efficiency. Assignment to a field with no interest only yields the foregone result "they couldn’t do it," which becomes no data — only performance in a field of interest can be interpreted as "this member’s secondary talent." Random assignment looks fair, but for the experiment’s purpose (discovering the team’s optimal tactics) it’s actually noise.

Answer 2. To keep consulting as a "last resort" and protect the data’s purity. No discarded hypotheses means nothing tried alone, and a question in that state is not consulting but a handover of the problem. Also, the discarded-hypothesis list reduces the answerer’s time — no need to reopen doors already closed. The requester’s diligence determines the answerer’s cost.

Answer 3. First, that Sujin has a secondary talent for crypto — points came out of a non-main field, so a second-responder candidate was discovered. Second, that the whole team’s pwn depends absolutely on Jiyeon alone — a structure was exposed where that field’s score goes to 0 if the owner is missing. One is a harvest (rediscovered strength), one is an alarm (weak link), and both are data that would stay invisible forever at fixed-division competitions.

Answer 4. Because an experiment must repeat for improvement to be judged. One rotation is only "a snapshot of the current state"; only by re-measuring the same metrics (especially consulting cost and independent-reach boundaries) at the next experiment can you judge "did growing second responders work?" A plan without a date never runs again — which is why the document’s last line is the next experiment date.

Completion Criteria Checklist

[ ] I wrote the role-rotation agreement as a document before the competition and got everyone’s confirmation
[ ] Each person prepared their non-main field’s cheat sheets, write-ups, and library
[ ] I left a "solo-capable boundary" sentence on my personal record card
[ ] I made consulting requests by the form and recorded the time on both sides
[ ] I computed the score ratio versus fixed division and the total consulting time
[ ] I made the weak-link map (list of single-responder fields)
[ ] I fixed the rotation cycle, second responders, and next experiment date in the final tactics document

6. Common Pitfalls & Fixes

Wall 1. A teammate says "I’ll sit this competition out"

Symptom: at the agreement stage, "non-main fields are no fun."

Cause: the agreement failed to persuade on purpose — to a points-loving member, the experiment looks like pure loss.

Fix: show them 3-4’s measured sentence — "if Jiyeon is out, pwn goes to 0" is everyone’s problem. And emphasize assignment principle 1 (interest first). If they still object, a partial rotation where only the objecting member keeps their main field is also a valid experiment — just note in the records that this member’s data doesn’t exist.

Wall 2. Mid-competition, "should I just do it myself" bursts out

Symptom: a frustrated main-field owner takes over the screen.

Cause: when the team’s score is visibly dropping, patience collapses — a normal reaction.

Fix: re-reading agreement item 4 is not enough. Install a device — consulting is voice/text only; the keyboard is never handed over. And run the answerer’s 10-minute timebox on a timer. What keeps rules is not willpower but procedure.

Wall 3. The score is so miserable that everyone’s spirit dies

Symptom: late in the competition, people give up from low morale.

Cause: when the drop is bigger than expected, the "experiment" frame collapses.

Fix: re-apply the frame once at the midway check — "what we’re collecting right now is not points but boundary data." And a real-world tip: allowing everyone to return to their main fields for the last 2 hours — the experiment data is already collected, and grabbing a few problems in main fields at the end preserves morale. Just record the return time explicitly so the data isn’t contaminated.

Wall 4. I made the weak-link map and every field is "1 owner"

Symptom: like 3-4’s measurement, every field gets a ⚠.

Cause: that’s the normal state of a 4-person team — not a surprise, but a call to set priorities.

Fix: the consulting log tells you the priorities. The field that needed "the concept itself explained" (pwn in the example) is number one — it means the transfer cost is highest. Conversely, a field resolved with 8 minutes of "correcting a problem misread" already has high transferability. Don’t try to fix everything; growing a second responder for one field by the next experiment is a realistic plan.

Wall 5. The experiment was fun, so someone suggests rotating every competition

Symptom: a proposal to repeat the experiment while ignoring the score drop.

Cause: a positive reaction from feeling the experiment’s learning effect — but it bends the team’s score growth curve.

Fix: this is where the final tactics document does its job — with the rotation cycle agreed as a number (e.g., 1 in 4), the next proposal becomes a document-revision discussion rather than an emotional argument. When the criterion lives in a document, decisions are fast.

7. Summary

Today’s Concepts

Concept	One-line explanation
Role rotation	An experiment that pays points as the cost to buy a map of the team
Agreement	"This one is for learning," documented — blocking mid-competition wobble
Consulting form	No request without discarded hypotheses — protecting data purity and answerer cost
Knowledge-transfer cost	Total consulting time — the price tag of a field vacancy
Weak link	A single-responder field — a structure where the owner’s absence means 0 points
Tactics ratio	How much fixed + how much rotation — the experiment’s destination is a ratio, not a dichotomy

Today’s Tools & Templates

Tool/template	What it does
Rotation agreement	Pre-fixing purpose, assignments, rules, and prohibitions
Personal record card	The measuring device for the "solo-capable boundary"
Consulting request form	The format of knowledge transfer and its cost record
`step293_tactics.py`	Comparing scores and costs of fixed vs. rotation
Final tactics document	Fixing the cycle, second responders, and next experiment date

The Core Instinct

A good team’s condition is not "everyone is strong" but "it keeps running no matter who’s missing." The ⚠ marks today’s experiment exposed are not criticisms but invitations — the list of what the team will grow over the next half-year.

And one more hidden harvest of rotation to note — the main-field owner’s experience of teaching. Someone who has done a 10-minute consulting session learns which concepts in their field are hard for others, and that changes their write-ups and their explanatory power. The experiment’s cost was paid in points, but the interest returns to the whole team.

Once every box is checked, Step 293 is complete.