Step 105. ★ Review — Cataloging Wargame Techniques
Level 2 — Security Introduction and Attack Skill Basics | Difficulty ★★☆☆☆ | Estimated time: 2 hours
Prerequisites: you’ve solved Steps 96–104 (Bandit 0–30, Natas 0–15). Your personal wiki from Step 89 is open.
- What you need: your personal wiki (or a Markdown editor), all your write-ups so far, and Bandit/Natas access for re-solving.
- ⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime.
- A note on today’s format: we’re not learning a new technique today. This is a ★ review chapter — a day to reassemble problems you’ve already solved into units called "techniques."
By now you’ve solved about sixty problems. But think about it: those sixty problems are really variations of only twenty-some techniques. Conditional find searches appeared three times, source-code reading five times, cookie manipulation twice. The problem is that these repetitions are scattered in your head with no structure.
Today’s goal is to capture that scatter in a table. Once your technique cards are organized, your reaction to a new problem changes — from "where do I start?" to "oh, this is that pattern again." The catalog isn’t a document you write once and finish; it’s the table of contents of your personal armory, one that grows for the rest of your 500 days.
1. Learning Objectives
By the end of this chapter, you will be able to:
- List every technique you used in Bandit 0–30 and Natas 0–15 without omissions
- Organize techniques into four categories: reconnaissance, authentication/session bypass, privilege escalation, and data processing
- Attach "signs (when to think of it)" and "tools/commands" to each technique to build technique cards
- Pick the three problem types you got stuck on most and verify your skill by re-solving them
- Save catalog v1 in your personal wiki and define update rules
2. Background Knowledge — Today’s Tools and Concepts
Today’s Tools at a Glance
| Category | Details |
|---|---|
| Language/environment | Markdown documents (personal wiki), SSH/browser for re-solving if needed |
| Today’s commands | No new commands — a day to bundle everything so far into "techniques" |
| Concepts needed | Technique cards (signs, tools, representative cases), the 4-category frame, chunking |
| Today’s artifact | Wiki document wargame_technique_catalog_v1.md + 3 re-solve records |
2-1. Why Remember "Techniques," Not "Problems"
If you remember by problem, you need one memory per problem. If you remember by technique, twenty slots can hold hundreds of problems. Chess and programming research has repeatedly confirmed that the difference between experts and beginners is not memory but this chunking — a way of bundling experience into larger units.
This is exactly the midpoint of the wargame growth curve. Someone who has consciously bundled techniques even once starts new problems at a different speed than someone who hasn’t.
That’s also why review chapters are planted periodically in this curriculum. If you only run, your muscles grow but your form falls apart. Today is a day to stop and fix your form — the work of converting muscle (problems solved) into form (a system of techniques).
2-2. The 4-Category Frame
Here’s the basic skeleton this book proposes. Don’t force things to fit — if something overlaps, write it in both places.
| Category | The question it asks | Representative techniques |
|---|---|---|
| ① Reconnaissance & exploration | "What’s in here?" | ls -a, conditional find searches, view source, robots.txt |
| ② Authentication & session bypass | "How do I get past the threshold?" | Cookie tampering, header manipulation, SQL injection, encoding reversal |
| ③ Privilege escalation | "How do I gain higher privileges?" | setuid executables, cron script abuse, writable files |
| ④ Data processing | "How do I read this data?" | Encoding conversion (base64/hex/rot13), diff, sort+uniq, git history |
These four slots also run parallel to the phases of a real penetration test. No attack without reconnaissance, no interior access without authentication bypass, no takeover without privilege escalation.
2-3. The Three Fields of a Technique Card — Signs Are the Heart
A technique card has three fields.
### Technique: (example) find conditional search
- **Signs**: when there's a hint that "a file matching certain conditions is hidden somewhere on the server"
- **Tools/commands**: `find . -type f -size 1033c ! -executable`
- **Representative cases**: Bandit 5→6, 6→7
The Signs field is the heart of the card. Commands can be looked up with a search. But "the ability to recall this technique in this situation" belongs only to someone who has written the signs out in words. A card has one completion criterion — when you see a similar problem next time, will this card come to mind on its own?
2-4. The Classification Doesn’t Have to Be Perfect
Don’t spend time agonizing over questions like "is cookie tampering authentication bypass or data processing?" Classification is not truth — it’s an index. However the bookshelf is divided, what matters is whether you can find things later. If you can’t decide a slot within 30 seconds, write it in both and move on.
2-5. A Real-World Catalog — MITRE ATT&CK
An "industry-standard edition" of what you’re making today exists. MITRE ATT&CK is a massive catalog that enumerates and classifies attack techniques actually observed in real-world intrusions — hundreds of techniques organized with IDs under phases (tactics) such as reconnaissance, initial access, privilege escalation, and defense evasion. If you’ve ever seen an incident report say "used T1059-family techniques," that number comes from this catalog.
Today’s four categories are a tiny introductory version of that catalog. If you build the habit of version-controlling your personal armory now, when you meet ATT&CK later you’ll read it as "ah, this is an expanded edition of my catalog." The habit of systematizing itself is a professional skill.
3. Follow Along
3-1. Scraping the Techniques Together — The Raw List
Open a new wiki document wargame_technique_catalog_v1.md and, skimming your write-ups from Steps 96–104, list every technique you used. Don’t organize yet — write it raw. A starter list for reference:
hidden files (ls -a), special filenames (./-, spaces), identifying with file,
find size/condition search, encoding conversion (base64, hex, rot13, tr),
diff comparison, sort+uniq duplicate hunting, netcat connection, port-scan intuition,
connecting via SSL (openssl s_client), reading source code (PHP), robots.txt,
following includes, path traversal (../), encoding reversal, command injection,
bypassing (blacklist) filters, hidden input manipulation, cookie value tampering,
header (Referer/User-Agent) manipulation, digging through git history, setuid executables,
cron script abuse, writable folder exploitation, XOR key recovery,
cookie forgery (after crypto analysis), file upload bypass, SQL injection, Blind SQLi
Around thirty is normal. If your write-ups contain techniques not in this list, those are the more valuable entries.
3-2. Placing Them into the Four Categories
Sort the raw list into the four slots from 2-2. A table format is recommended.
| Technique | Category | Signs | Tools/commands | Representative cases |
|---|---|---|---|---|
| find conditional search | ① | "a hidden file somewhere" hint | find . -size 1033c |
Bandit 5 |
| Reading source code | ① | a view-source button, curiosity about the logic | View sourcecode | Natas 6–15 |
| Cookie tampering | ② | login state depends on a cookie | DevTools Application tab | Natas 4–5 |
| XOR key recovery | ④(→②) | cookie is a weird string + XOR logic in source | Python ^ |
Natas 11 |
| SQL injection | ② | a form whose input looks like it becomes a DB query | ' OR '1'='1 |
Natas 14–15 |
| setuid files | ③ | need to do something as the file’s owner | find / -perm -4000 |
Bandit 20 |
| cron abuse | ③ | found a script that runs periodically | cat /etc/cron.d/* |
Bandit 21–23 |
How to read it: entries like "XOR key recovery" whose category is ambiguous are marked with an arrow showing both. The analysis is ④ but the goal is ② — this kind of marking actually helps you remember the technique’s nature more accurately later.
3-3. Refining the Signs Field — Today’s Core Labor
Rewrite each row’s "Signs" in your own words. Bad and good examples:
-
Bad sign: "when using find" (explaining a technique with the technique — no help at all)
-
Good sign: "when the hint mentions file-attribute conditions like size, permissions, or owner"
-
Bad sign: "in an SQL injection problem"
-
Good sign: "when it’s a login/search form and you can see source where the input goes straight into the query"
A sign is a note to your future self. You’re writing: "when you see this scene, pull out this card."
3-4. Re-solving 3 Problems — Validating the Catalog
If you just make the catalog and stop, it’s only a document. Pick the three problem types you got stuck on most and solve those problems again. Rules:
- Solve looking only at the catalog, not your old write-up
- While solving, observe "did the sign actually come to mind?"
- If it didn’t, fix the Signs field right there on the spot
If you get stuck during a re-solve, the card was written badly; if it flows smoothly, the card is alive. This feedback is what turns the catalog into a real weapon.
A format like this is recommended for re-solve records.
[Re-solve 1] Bandit 20 (setuid executable)
- Solved with only the card: success / took 6 minutes
- Sign that came to mind: the word "setuid" in the hint made me open slot ③ immediately
- What I fixed: added "a file that makes something run as a different user" to the signs
3-5. Defining Update Rules
Write rules at the bottom of the document.
### Update rules
- When I meet a new technique, add 1 card immediately (version +0.1)
- Once a month: if a technique has more than 3 cases, split it into sub-variants
- If categories keep overlapping, doubt the classification itself and revise to v2
The reason for version numbers is to remind yourself that this document is not a "finished product" but a "living table of contents."
The rules don’t need to exceed three lines. Three rules you’ll keep beat ten rules you won’t.
3-6. How to Use the Catalog — Decide the Reading Order in Advance
The finished table is something you open "when you meet a new problem." Decide the procedure too.
- Look at the problem (or server) → scan category ① top to bottom first
- If something catches, open that technique’s card and check the commands
- If authentication blocks you, go to ②; if privileges are lacking, ③; if data won’t read, ④
The gap between someone who has decided "what to open first in front of an unfamiliar problem" and someone who hasn’t widens enormously in the second half of the wargames. The catalog is both a record and your entry procedure document.
4. Missions & Exercises
Mission — Complete Technique Catalog v1
- Complete
wargame_technique_catalog_v1.md— at least 25 techniques, with signs, tools, and representative cases mandatory in every row - Each of the four categories must contain at least 3 techniques
- Pick 3 types you got stuck on, re-solve them using only the catalog, and record the results (success/failure and the signs you fixed) in the document
- Write the 3-line update rules at the end of the document
Exercises
Exercise 1. Explain the difference between problem-level memory and technique-level memory using the concept of "chunking."
Exercise 2. Of the three fields of a technique card (signs, tools, cases), why is "signs" the heart? Answer the retort: "can’t you just search for the commands?"
Exercise 3. Which of the four categories would you put "breaking security through obscurity (finding hidden files)" into? And explain how that classification helps you judge a problem situation.
Exercise 4. Explain why the catalog must keep being updated rather than "made once and done," connecting it to the learning ahead (CTF, real-world machines).
5. Model Answers & Completion Criteria
Mission Model Answer
An example skeleton of the catalog (yours should be longer and more specific than this):
| Category | Technique count (example) | Representative cards |
|---|---|---|
| ① Reconnaissance & exploration | 8 | Source reading, find conditional search, robots.txt |
| ② Authentication & session bypass | 7 | Cookie tampering, SQLi, header manipulation |
| ③ Privilege escalation | 5 | setuid, cron, writable files |
| ④ Data processing | 8 | Encoding conversion, diff, XOR analysis |
How to verify: ① does it have 25+ techniques with no empty fields (missing signs, etc.)? ② are the 3 re-solves recorded, with the fixed signs noted alongside failures? ③ are the update rules there? ④ can you read any part of the document and immediately re-execute that technique? — that is the final exam.
Exercise Answers
Answer 1. Chunking is a cognitive strategy of bundling scattered information into meaningful units. If you remember by problem, every new problem is always "something never seen," but if you’ve bundled by technique, a new problem is recognized as "a new face of a technique I know." Memory capacity stays the same, but retrieval speed changes.
Answer 2. Command syntax is searchable, but the judgment that "now is the time to use that command" is not. Search only works after recall. The Signs field trains exactly that "recall," which is why it’s the heart of the card.
Answer 3. It belongs naturally in ① reconnaissance & exploration — it’s an activity of "finding what’s hidden." Classified this way, the situation "what do I do on a server/page I’ve never seen?" becomes the signal to open slot ①. Classification is the starting point of thought itself.
Answer 4. The CTF problems and real-world machines ahead are more complex variants of the same techniques. If the catalog isn’t updated, the index freezes at your Step 105 skill level. New technique additions, case accumulation, and differentiation (one technique splitting into multiple variants) must happen for this document to become a record of the growth curve itself.
Completion Criteria Checklist
- [ ] I completed catalog v1 containing at least 25 techniques
- [ ] Every card has all three fields: signs, tools, representative cases
- [ ] The Signs fields describe situations, not restatements of technique names
- [ ] I placed at least 3 techniques in each of the four categories
- [ ] I performed 3 re-solves using only the catalog and recorded them
- [ ] For re-solves where I got stuck, I fixed the Signs field on the spot
- [ ] I wrote the 3-line update rules at the end of the document
6. Common Pitfalls & Fixes
Wall 1. You stall out searching for the perfect classification
Symptom: you’ve been pondering "is this technique ② or ④?" for 30 minutes.
Cause: you’ve mistaken classification for truth-seeking. Classification is an index, not truth.
Fix: the 30-second rule — if you can’t decide, write it in both and move on. Step 105’s completion criterion is not "accurate classification" but "classification you can recall next time."
Wall 2. You end up writing "when using XX" in the Signs field
Symptom: every card reads like "when using find: use find."
Cause: the habit of writing from the technique itself rather than the scene of the problem.
Fix: start the sentence like this — "when the screen/hint shows ___." What fills the blank is the sign. Review the bad/good examples in 3-3.
Wall 3. You have no old write-ups, so you can’t remember the techniques
Symptom: you definitely solved it, but you don’t know what you used.
Cause: there are gaps in Steps 96–104 where the recording beat (④ of the cycle) was skipped.
Fix: quickly re-solve the problems you can’t remember and rebuild the records — those are exactly your 3-4 re-solve candidates. And this experience itself is worth writing in the document as evidence of the lesson: "a discovery without a record is a discovery that never happened."
Wall 4. You made the catalog but nothing comes to mind during re-solves
Symptom: even looking at the table, you go blank in front of a problem.
Cause: "making" the table and "thinking with" the table are different things. The cards haven’t moved into your head yet.
Fix: that’s normal. Increase the re-solves from 3 to 5–7. Repeat the cycle solve-with-table → solve-with-table-covered, and the cards will migrate into your head.
Wall 5. You make the document and never open it again
Symptom: v1 is still v1 a month later.
Cause: there are no update rules, or the rules aren’t on your calendar.
Fix: fix "add new techniques immediately" as a habit, and "monthly differentiation check" as a calendar reminder. An armory only grows for the person who uses it.
7. Summary
Today’s Concepts
| Concept | One-line explanation |
|---|---|
| Technique card | An index card with three fields: signs, tools, representative cases |
| Signs | A situational description — "when you see this scene, pull out this card" — the heart of the card |
| 4-category frame | Reconnaissance / authentication & session bypass / privilege escalation / data processing |
| Chunking | A cognitive strategy of bundling experience into technique units to speed up retrieval |
| Classification is an index | A device for finding, not truth — overlap is fine |
| Re-solving | The only exam that validates the catalog’s effectiveness |
Today’s Commands
| Command/tool | What it does |
|---|---|
| (no new commands) | Today’s tools are documents and re-solving |
| Personal wiki (Step 89) | The storage for catalog v1 |
| SSH/browser for re-solving | The equipment for validating the cards |
An Instinct More Important Than Commands
The real harvest of wargames is not a list of passwords but an eye that recognizes patterns. The table you made today is the first edition of that eye’s map. From now on, the number of times the sentence "this is that pattern again" comes to mind in front of a new problem is your skill. There’s only one way to increase that count — the repetition of making the catalog, reopening it, and fixing it. And this organizing habit travels beyond wargames — classifying vulnerabilities in reports, classifying attack techniques in incidents (in the field, they use MITRE ATT&CK, a giant "technique catalog"), even review cards for what you’ve studied — it’s all the same work as today. A map proves its worth not on the day it’s drawn but on the day it’s unfolded again. Write the update date on your calendar.
Once every box is checked, Step 105 is complete. Click the checkbox in the sidebar to save your progress.