Step 303. ★ Level 3 Comprehensive Evaluation: Score Analysis of the Last 3 Competitions + Level 4 Plan — Close with Data, Open with Design

Level 3 — Real-World CTF & Advanced Offensive Skills | Difficulty ★★★☆☆ | Estimated time: 2 days (eligibility verification + score analysis + Level 4 plan document)

Prerequisites: you’ve completed Steps 176–302. This chapter is Level 3’s graduation review — no new techniques — and the blueprint of the professional zone.

What you need: twelve competition logs and retrospectives, the Write-up repository, a notebook (or a blank document), and one generous day of time.
Caution: today is "measurement day." Evaluate your skill from records, not feelings, and design the next year on top of that data.
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime.

Just as you closed Level 2 with a single table in Step 175, today you close Level 3 with data. The scale differs, though — this time you’re handling records of twelve real competitions, five specialized fields, and dozens of real machines. What these records tell you is not one number but a structure. Which fields produce points, where time leaks away, how far the top teams are.

And on top of that structure, you lay the bridge to Level 4. OSCP, bug bounty, 1-day analysis, domestic and international competitions — which path of the professional zone, in what order, starting when. Today’s deliverables are two: Level 3’s diploma and Level 4’s admission ticket.

1. Learning Objectives

By the end of this chapter, you will be able to:

Verify the Level 3 completion eligibility conditions (12 competition logs, 12 retrospectives, 3 Hard-tier Write-ups, 50 cumulative Write-ups) with evidence
Organize all of Level 3 (Steps 176–302) into a per-track "map of what I learned"
Analyze the score structure of the last 3 competitions to produce per-field score rates, time efficiency, and trends
Organize your position with SWOT and fix strengths/weaknesses into sentences
Establish a Level 4 entry plan (track selection, start point, 1-year goals) as a document

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	Notebook and document tools, original competition logs, one verification Python script
Today’s commands	No new commands — analysis runs as measured output from a local Python script
Concepts needed	The evidentiary nature of eligibility conditions, score-structure analysis (score rate/efficiency/trend/gap), SWOT, entry strategy
Today’s deliverable	Eligibility verification table + map of what I learned + 3-competition analysis report + SWOT + Level 4 plan document

2-1. Why Data — Feelings Are Not Evidence for a Graduation Review

The feeling of "I’m pretty good now" is precious, but the review’s evidence is records. Records hold what feelings miss — the composition of scores, not rankings, and the slope of the trajectory, not one competition.

One rule for all of today’s deliverables — every claim carries coordinates from the logs. Not "my Web got stronger" but "Web score rate #10 71% → #12 75%, above season average." A sentence without coordinates exists today only as a draft.

2-2. Eligibility Conditions — The Four Proofs of the Graduation Review

Level 3 completion has four eligibility conditions.

Condition	Evidence	What it proves
12 recent competitions entered & scored	12 competition logs	Repeated real-world experience — skill, not one round’s luck
12 competition retrospectives	Retrospective document links	The debrief habit that turns experience into knowledge
3 Hard-tier Write-ups	3 published solutions	Independent solving power on high-difficulty problems
50 cumulative Write-ups	Repository count	The total volume of explainable knowledge

The four conditions each examine a different muscle — participation (execution), retrospectives (analysis), Hard (depth), accumulation (communication). If one is empty, that muscle is not yet proven. And said in advance — falling short is fine. Set a period to fill the shortfall and retry the evaluation. Graduation is not a closing door; it is receiving Level 4’s admission ticket.

2-3. Score-Structure Analysis — Four Metrics

From the logs of the last 3 competitions (#10–#12), extract four metrics.

Per-field score rate: score ÷ that field’s maximum. The map of strengths and weaknesses.
Time efficiency: score ÷ minutes invested. How cheaply you obtain the same points.
Trend: the direction of change across the 3 competitions. Rising, or stagnant.
Gap: the distance to top teams. Did they solve what we couldn’t?

The four metrics correct one another. Low score rate with low efficiency is a true weakness; low score rate with high efficiency is the illusion of "that field just had few points on offer." Drawing a conclusion from a single number is this analysis’s only trap.

2-4. SWOT — Translating Data into the Language of Position

When the analysis is done, move it into SWOT’s four cells. At Level 3’s scale, SWOT fills like this.

S (strengths): fields with top score rates — where your mains are proven
W (weaknesses): fields with both score rate and efficiency low — reinforcement targets, not avoidance targets
O (opportunities): external doors — the domestic competition season, bug bounty programs, team expansion
T (threats): internal risks — stagnation risk, a scattering team, motivation burnout

SWOT is not invention but translation. The numbers of 2-3 fill S and W; the Level 4 map (2-5 below) fills O. A numberless SWOT becomes a cover letter; a numbered SWOT becomes a strategy document.

2-5. The Level 4 Map — Five Branches of the Professional Zone

Look at Level 4’s structure (Steps 304–348) first. By the plan document’s criteria, the professional zone is five blocks.

Block	Steps	Contents
OSCP track	304–313	Understanding the exam, practice machines, report training, mock exams, sitting the practical and its retrospective
Bug bounty	314–319	Understanding the system, recon/discovery/verification on real services, reports, triage handling
1-day analysis	320–323	Patch diff analysis, CVE reproduction and report publication, open-source contribution
Competition cycle	324–329, 336–340, 347	Domestic qualifiers/finals, international competitions, championship challenge, gap analysis
Career & giving back	330–335, 341–348	Knowledge-absorption routines, mentoring/talks, portfolio, new-area exploration, team leading

Today’s Level 4 plan places three things on this map — which block first (order), when to start (timing), what state am I in one year later (goals). The clue to order lies in 2-3’s analysis — if your strength was proven in live penetration (the HTB track), OSCP is the natural first block; if proven in web, bug bounty is the early monetization path.

3. Follow Along

3-1. Verifying Eligibility — With Evidence Links

Open the form and fill the four conditions. Each row must carry the evidence’s location (log file, repository link, count screenshot).

[Level 3 completion eligibility verification table] (screen example)
Condition                     Standard  Actual   Evidence                      Verdict
Competitions entered/scored   12        12       logs/ctf-01.md ~ ctf-12.md    Pass
Competition retrospectives    12        12       blog/retros/ (list capture)   Pass
Hard-tier Write-ups            3         3       blog/writeups/hard-* 3 items  Pass
Cumulative Write-ups          50        51       repo list + count capture     Pass

How to read it: "Shortfall — fill plan" in the verdict column is also normal operation. In that case the plan’s form is "what, by when" — e.g., "1 Hard-tier Write-up short → fill within 3 weeks with a re-attack write-up of a Step 273 machine, then re-evaluate." A shortfall is not rejection but a schedule.

Two rules when designing the fill period. One, the fill targets only the missing condition — a plan that reviews all of Level 3 when one condition is short is overkill. Two, put the re-evaluation date on the calendar — a fill plan without a date is another name for permanent postponement. The other conditions’ evidence stays valid, so the re-evaluation only re-examines the filled row.

3-2. The Map of What I Learned — All of Level 3 at a Glance

With eligibility confirmed, organize the journey of Steps 176–302 into a per-track map. Below is the skeleton — filling each row’s "what remains" cell with your own records is the task.

Track	Steps	Core achievement	What remains
CTF intro & field selection	176–181	Tasted 5 fields, fixed main/sub fields	(e.g., main Web, sub Forensics)
Basic stamina (ASM/BOF)	182–190	Assembly, gdb, buffer overflow, pwntools, team formation
Web deep dive	191–202	Advanced SQLi through SSTI/SSRF/XXE/deserialization, Webhacking.kr, mid-check
Pwn track	203–214	Shellcode, ROP, ret2libc, Format String, GOT/heap intro
Reversing track	215–226	Ghidra/x64dbg deep dive, anti-debugging, unpacking, keygen, mid-check
Crypto track	227–238	RSA implementation & attacks, Cryptopals, AES modes, hashes, DH/ECC
Forensics track	239–250	File signatures, stegano, pcap, memory/disk forensics, incident analysis
Live platforms	251–278	THM/HTB accumulation, AD, pivoting, Medium graduation, Hard debriefs, speed training
Competition cycle	279–302	12 competitions, debrief blocks A/B/C, tactic experiments, qualifier prep system

How to read it: this table’s "what remains" cells are the Level 4 plan’s material, and its "core achievement" cells are the resume and portfolio’s material. If Step 175’s correspondence table was Level 2’s compression, this map is Level 3’s index — dozens of hours of practice unfold behind each row.

Three criteria for filling the "what remains" cells. ① Things started and dropped — e.g., "heap exploitation stopped at the intro." ② Things weakly proven — learned but never validated in a competition or machine. ③ Things where interest remains — candidates to connect into Level 4’s new-area exploration (cloud/mobile/IoT). If any of the three applies, write it down. A track with an empty cell is a declaration of "I did what this Level called for," so when leaving one blank, note the reason in parentheses.

3-3. Organizing the Last 3 Competitions’ Data

From the logs of #10, #11, and #12, gather per-field (score, maximum, time invested). If a competition log has no maximums, substitute "the sum of point values of problems opened in that field." Organization example (fabricated sample — you fill with your logs’ actual numbers):

[Raw data for 3 competitions] (fabricated sample)
      teams/rank    Web        Pwn        Rev        Crypto     Forensics
#10   412 / 156    500/700    200/500    300/400    100/400    300/300
#11   365 /  98    600/700    300/500    300/400    200/400    300/300
#12   438 / 121    600/800    400/600    400/400    200/500    400/400
(each cell: score/maximum — minutes invested aggregated from the log's start/finish times)

3-4. Measured Run of the Analysis Script — Computing the Four Metrics

Feed the organized data to the analyzer (step303_analysis.py). The core logic computes per-field score rate, trend, and efficiency.

Input (part of step303_analysis.py)

# per competition: (team count, our rank, per-field (score, maximum, minutes invested))
DATA = {
    "#10": (412, 156, {"Web": (500, 700, 190), ... }),
    "#11": (365,  98, {"Web": (600, 700, 180), ... }),
    "#12": (438, 121, {"Web": (600, 800, 200), ... }),
}

python step303_analysis.py

=== Score-structure analysis of the last 3 competitions ===

Field           #10 rate      #11 rate      #12 rate      Trend
Web               71%           86%           75%         ▲
Pwn               40%           60%           67%         ▲
Rev               75%           75%          100%         ▲
Crypto            25%           50%           40%         ▲
Forensics        100%          100%          100%         ―

Competition #10: 156th of 412 teams (top 38%)  total 1400 pts  efficiency 1.8 pts/min
Competition #11: 98th of 365 teams (top 27%)   total 1700 pts  efficiency 2.4 pts/min
Competition #12: 121st of 438 teams (top 28%)  total 2000 pts  efficiency 2.6 pts/min

Fields with the lowest time efficiency (= redesign candidates):
  #10: Crypto (0.8 pts/min)
  #11: Pwn (1.5 pts/min)
  #12: Crypto (1.5 pts/min)

(Measured 2026-09-09 — local script run result. The competition data is a fabricated sample.)

How to read the output: let’s read what this sample says. ① The ranking rose from top 38% to 27–28% and settled in the goal zone, and since total score and efficiency (1.8 → 2.6 pts/min) rose together, this is structural ascent, not luck. ② Forensics is on a perfect-score streak — proven as a main candidate. ③ Crypto is bottom-tier in both score rate and efficiency — falling back to 40% at #12 shows a "structural weakness, not a blip." ④ The gap analysis’s direction — the distance to top-10% teams, in this sample, arises mostly in Crypto and high-point Pwn problems.

Read your own output in the same order — trajectory (rising?), mains (near maximum?), weakness (bottom in both score rate and efficiency?), gap (what did the top teams solve that we didn’t?).

3-5. Writing the SWOT — Translating the Numbers

Move 3-4’s results into the four cells. An example based on the sample data.

[SWOT — at Level 3 completion] (screen example)
S strengths: Forensics perfect-score streak (3/3 competitions), Web top-tier (71->86->75%)
             -> "Proven mains: Forensics, Web"
W weaknesses: Crypto score rate 40% or below + lowest efficiency (0.8~1.5 pts/min)
             -> "Structural weakness: Crypto — the top-20% wall without reinforcement"
O opportunities: entering the domestic competition season (Steps 324~326), bug bounty and
                 incident-analysis areas with high Forensics demand, the team's continuation
T threats: motivation vacuum after the 12-cycle season ends (stagnation risk),
           the risk of Crypto avoidance hardening into habit

How to read it: check that each cell’s first line came from numbers — S and W must be direct translations of 3-4’s output. T’s "motivation vacuum" is the only cell that comes from experience rather than numbers — this moment, when twelve cycles’ momentum cuts off, is actually the most common dropout point. This is the real reason the Level 4 plan is needed.

3-6. The Level 4 Entry Plan Document

Place order, timing, and goals on the map (2-5). The criterion for choosing the first block is not interest but the conversion path of proven assets — which block turns my records into external recognition (certifications, accepted reports, results) fastest.

Proven asset (3-4’s numbers)	Natural first block	Conversion path
Live-platform track accumulation (HTB Medium graduation, Hard debriefs)	OSCP (304–313)	machine-taking power → public certification
Web field’s top score rates	Bug bounty (314–319)	web attack power → real-service reports
Reversing track completion	1-day analysis (320–323)	binary-dissection power → CVE analysis
Competition-operation maturity (strategy docs, team communication)	Competition cycle (324–329)	team tactics → domestic finals results

How to read it: the mapping is an example of correspondence, not a command. Choose the row your numbers point to. And assign sequence numbers to the blocks you didn’t choose too — Level 4’s 45 steps are all roads you eventually walk; what you decide now is only the order.

A plan example following the sample data’s SWOT.

[Level 4 entry plan] (screen example)
First block: OSCP track (304-313)
  Grounds: the live-platform track (Medium graduation, Hard debriefs) is the asset —
           public proof of live penetration skill is the fastest monetization path
  Start: in 2 weeks (until then, organize retrospective #12 and this document)
Parallel: bug bounty system study (314) — weekends between OSCP mock exams
Reinforcement: Crypto — resume Cryptopals twice a week regardless of Level 4 entry
               (neglecting W makes T real)
1-year goals: OSCP pass + first accepted bug bounty report + domestic finals appearance
Measurement: record progress on this document's '1-year goals' row every quarter

How to read it: check for three defects. ① Do the grounds connect to SWOT’s numbers? ② Is the start point a calendar date, not "someday"? ③ Are the 1-year goals measurable ("improve skill" is a wish, not a goal)? With all three present, the document is a plan.

Note: don’t leave a "planless blank" between now and the first block’s start date. That gap is exactly where 3-5’s T (motivation vacuum) grabs your ankle. Write the pre-start tasks — organizing retrospectives, backing up the pack, restructuring the team — into the plan document too.

3-7. The Full Level 3 Retrospective — TOP 5 Moments That Changed Me

The final process is not numbers. Skim the 128 steps of Steps 176–302 and pick five moments of which you can say "I was different after this moment." The format is free, but attach a step number to each item. Screen example:

[Level 3 — TOP 5 moments that changed me] (screen example)
1. Step 186 — the moment I overwrote the RET address and a shell popped. "Memory is not paper but a door"
2. Step 202 — the first web problem I solved without the book. The first sensation of independence
3. Step 256 — first independent root on HTB. The id command at the end of 6 stuck hours
4. Step 275 — the day I read a top player's Write-up and saw the narrowness of my thinking
5. Step 302 — the end declaration of the twelfth competition. The day I came to see trajectory over ranking

How to read it: this list has two uses — one, a reserve of motivation to pull out when Level 4 exhausts you. Two, the teaching material for someday explaining Level 3 to a junior or teammate. If the numeric retrospective (3-4) is the head’s organizing, these five lines are the heart’s.

Fix the selection procedure and you won’t get stuck. First skim the step list top to bottom and mark everywhere you "paused" — fifteen is fine. Then ask each candidate one question — "without this moment, would I be different now?" Keep only the yeses. Finally, when cutting to five, mix the kinds — a technique moment (first exploit), an attitude moment (the first day you finished a debrief to the end), a relationship moment (the day the team formed). A list with a balance of kinds is closest to Level 3’s actual shape.

4. Missions & Exercises

Mission — Complete the Level 3 Comprehensive Evaluation Document

Complete one comprehensive evaluation document composed of the following five parts.

Eligibility verification table: the four conditions with evidence locations (3-1). Shortfall items as "what, by when" fill plans.
Map of what I learned: fill 3-2’s nine track rows with your records’ "what remains."
Score analysis report: the raw-data table of the last 3 competitions + the analysis script’s output + one paragraph each interpreting the four metrics (trajectory/mains/weakness/gap).
SWOT: four cells, with S and W as direct translations of the analysis numbers.
Level 4 entry plan: first block and its grounds, start date, 1-year goals (measurable), measurement method.

Attach 3-7’s TOP 5 at the end of the document.

Exercises

Exercise 1. Map the four eligibility conditions to the muscles they each prove (execution/analysis/depth/communication), and explain why the completion condition can’t be satisfied by one muscle alone.

Exercise 2. Explain how the prescription differs between a field with low score rate but high time efficiency and a field low in both.

Exercise 3. Give two grounds on which Crypto was judged a "structural weakness" in 3-4’s sample output.

Exercise 4. Connecting to 3-6’s "measurement method" row, explain why the Level 4 entry plan’s "1-year goals" must be measurable.

5. Model Answers & Completion Criteria

Mission Model Answer

Check against these verification criteria.

Evidentiary quality: does every verdict in the eligibility table carry coordinates of a log, link, or capture? A single "I think I did" sentence sends it back to draft.
Map completeness: are all nine track rows’ "what remains" cells filled — an empty cell is not forgotten but not-yet-evaluated.
Cross-validation of analysis: is the weakness verdict grounded simultaneously in both score rate and efficiency? A conclusion from one number is unfinished.
SWOT’s translational quality: can each S and W line be traced to a specific number in the analysis report?
The plan’s three-defect check: grounds-number connection, a calendar start date, measurable goals — all three present?
TOP 5 attached: does each item carry a step number?

Exercise Answers

Answer 1. Twelve competitions prove execution (repeated real-world experience), 12 retrospectives prove analysis (turning experience into knowledge), 3 Hard-tier Write-ups prove depth (independent high-difficulty solving), and 50 cumulative Write-ups prove communication (explainable knowledge). One alone is insufficient because a professional’s work is the circulation of these four. Do much without debriefing and you stagnate; only debrief and your real-world edge dries up; repeat only the easy and your ceiling stays low; fail to explain and the knowledge never fully becomes yours (Step 278). The four conditions are the device demanding that no link of that circulation is broken.

Answer 2. Low score rate + high efficiency may be the illusion of "that field simply offered few points" — you recovered everything available in short time, so the prescription is a strategy tweak (raise its priority) at most. Low in both is a true weakness — time invested doesn’t convert to points, so the prescription is reinforcement learning, and it must enter the Level 4 plan as an explicit item (3-6’s "reinforcement" row). The same "low score" has different causes and different prescriptions, and the efficiency metric makes that distinction for you.

Answer 3. ① The score rate was bottom-tier in all three competitions (25%, 50%, 40%), and #11’s rebound broke at #12, revealing it wasn’t a temporary rise. ② Time efficiency was the lowest of all fields at #10 (0.8 pts/min) and #12 (1.5 pts/min) — invested time doesn’t convert into points. Bottom in both score rate and efficiency, plus repetition across competitions — only with these two grounds can you attach the word "structural."

Answer 4. Because an unmeasurable goal allows no progress records, and without progress the "measurement method" row becomes a dead sentence. "OSCP pass," "first accepted report," "finals appearance" are all states recordable every quarter as O/X or a percentage. A goal like "improve skill," by contrast, gets reinterpreted at every quarterly check — a goal you can declare achieved or postponed at will performs no function of a plan. Measurability is not a quality standard for goals but an existence condition for plans.

Completion Criteria Checklist

[ ] I filled the eligibility verification table’s four conditions with evidence locations (shortfalls as fill plans)
[ ] I filled "what remains" for all nine tracks of the map of what I learned
[ ] I organized the raw-data table of the last 3 competitions from actual logs
[ ] I ran the analysis script and produced score rate, efficiency, trend, and gap
[ ] I wrote one paragraph each interpreting the four metrics (trajectory/mains/weakness/gap)
[ ] I completed SWOT’s four cells and connected S and W traceably to numbers
[ ] I wrote the Level 4 entry plan with first block, start date, and measurable 1-year goals
[ ] I attached the TOP 5 moments that changed me, with step numbers

6. Common Pitfalls & Fixes

Wall 1. A competition is missing its log and I can’t verify eligibility

Symptom: the logs of a few early competitions can’t be found.

Cause: record habits often settle in mid-season — a normal growth curve.

Fix: handle it in two branches. If a retrospective survives, check whether that document can serve as substitute evidence of participation; for a competition whose score itself is gone, honestly recount the definition of "12 scored competitions" from the start. If short, record it as a shortfall and build a fill plan (1–2 additional competition entries) — as 2-2 said, a shortfall is not rejection but a schedule. A fabricated pass shakes all of Level 4.

Wall 2. My analysis numbers look shabby next to the sample and I don’t want to write

Symptom: score rates are low overall and the document feels like self-flagellation.

Cause: this analysis’s purpose is not boasting but fixing coordinates — even low numbers, if accurate coordinates, are excellent input for Level 4 design.

Fix: start each interpretation paragraph’s first sentence with the trajectory — your sentence is not the ranking’s absolute value but the slope from #10 to #12. And remember: this document’s reader is you one year from now. What that you needs is not packaged numbers but an honest starting point you can look back on.

Wall 3. I want a gap analysis but there’s no top-team data

Symptom: you can’t know what the top teams solved.

Cause: things get published after a competition ends — the final scoreboard and top teams’ Write-ups.

Fix: even the scoreboard’s per-problem solve counts sketch the gap’s outline — how many teams solved what we couldn’t. Pick one top-team Write-up and lay it beside our log. Writing in one line whether the difference is "knowledge" or "procedure" — that is all a precise gap analysis is.

Wall 4. I want all five Level 4 blocks and can’t choose

Symptom: you want to write OSCP, bug bounty, and 1-day analysis all as the first block.

Cause: it’s not choosing but avoiding — pick one and you must bear the "regret" of the rest.

Fix: ask 3-4’s numbers. The first block’s criterion is one — "where is the asset that converts to external recognition fastest?" Choose by the asset’s proof path, not interest. The rest aren’t discarded; they get sequence numbers in the plan document. Ordered ambition is a plan; unordered ambition stagnates.

Wall 5. Picking the TOP 5, I can’t cut it down to five

Symptom: about ten come out. All of them precious.

Cause: no one who passed 128 steps has only five moments — a good signal.

Fix: change the criterion from "is it memorable" to "did I change after it." Pleasant moments and moments of change overlap but differ. If it still won’t shrink, pick five and gather the rest on a "next candidates" line at the document’s end — the very act of trimming is a debrief that skims all of Level 3 again.

7. Summary

Today’s Concepts

Concept	One-line explanation
Evidentiary eligibility conditions	Execution/analysis/depth/communication — four muscles; a verdict without evidence is a draft
Score-structure analysis	Score rate × efficiency × trend × gap — never conclude from one number
Structural weakness	Bottom in both score rate and efficiency + repetition across competitions
SWOT as translation	S and W are direct translations of analysis numbers; O and T come from the map and experience
The entry plan’s three defects	Grounds-number connection, a calendar start date, measurable goals
Handling a shortfall	Not rejection but a schedule — "what, by when"

Today’s Commands & Tools

Command/tool	What it does
`python step303_analysis.py`	3 competitions’ raw data → score rate/efficiency/trend/gap
Eligibility verification table	Cross-checking evidence locations for the four conditions
Map of what I learned (9 rows)	Level 3’s index — achievements and what remains
Comprehensive evaluation document (5 parts)	Verification/map/analysis/SWOT/plan + TOP 5 attached

The Core Instinct

In Level 3 you tasted five fields and fixed your mains, learned the language of assembly and memory, breached dozens of live machines alone, and played and debriefed twelve competitions. That long time became one document today — compressed into tables and numbers means it can be unfolded and used again anytime.

And remember what this document promises. The eligibility conditions’ evidence is real material you can submit as-is at any interview, any team application, and the score analysis’s numbers are the coordinates that will keep you, one year from now, from forgetting "where I came from."

Level 3 — congratulations on completing it. You have passed beyond being someone who sits competitions, and become someone who operates their own skill as data. Close the document, rest, and open it again on the date you set.

Once every box is checked, Step 303 is complete.