Step 202. ★ Midterm Check: Solve Three Intermediate Web Challenges Independently in a Row — The No-Write-up Zone

Level 3 — Practical CTF & Advanced Attack Skills | Difficulty ★★★★☆ | Estimated time: 12+ hours (spread over several days)

Prerequisites: you’ve finished the web track of Steps 131–201. The techniques and procedures from the Dreamhack cumulative solves, Juice Shop, and the Webhacking.kr stretch are second nature.

What you need: an account with access to intermediate web challenges you haven’t solved (Dreamhack difficulty 3–4 or PortSwigger intermediate labs), Burp Suite, a document for records, and a timer.
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. Today’s arenas, Dreamhack and PortSwigger, are legal learning platforms officially opened by their operators.

This is the graduation exam of the Web track. One rule — solve three intermediate challenges in a row without write-ups. If you get stuck on even one and look at a solution, that challenge is void. But a broken streak doesn’t send you back to the start — you pick a new challenge and attempt the three-peat again.

The purpose of this check is not to prove your skill but to measure it. It’s the day you find out whether your routine stands on its own in the place where hints and solutions have vanished. Because this is a checkpoint chapter, there are no new techniques — selection criteria, conduct rules, and a checklist for when you’re stuck are all there is. Server screens are shown as screen examples.

1. Learning Objectives

By the end of this chapter, you will be able to:

Apply challenge-selection criteria that keep the check fair (randomness, pre-blocking by type)
Run independent solves with a 4-hour cap per challenge and the checklist routine
Keep process records including hypothesis lists, attempted payloads, failure reasons, and breakthrough points
On failure, classify the failure type and assign a retraining address
Write your own write-up for each independently solved challenge

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	Every web tool so far — browser devtools, Burp Suite, Python
Today’s procedure	Random selection → 4-hour cap → process records → three-peat verdict → write-ups
Concepts needed	The definition of an independent solve, the three types of stuck, the allowed scope of research
Today’s deliverable	A three-peat record table + 3 write-ups

2-1. Why "Three in a Row"

One independent solve can be luck — you may have happened to draw a type you know. Even two in a row has luck mixed in. From three in a row, you enter a zone luck can’t explain: having cracked different materials and different tricks back to back is evidence that your routine and technique list actually work.

Conversely, if you look at a solution for even one, that challenge is not a measurement. The streak breaks, but failure is not a penalty — it’s data. Covered in 2-4.

2-2. Fair Selection — You Must Not Pick Knowing the Type

For the check to be a real check, challenge selection must be fair.

Unsolved only: only challenges absent from your solve records are candidates
Difficulty range: Dreamhack difficulty 3–4, or PortSwigger Practitioner (intermediate) labs
Random selection: draw from the candidate list with dice or random numbers. The moment you cherry-pick with "this one looks like SQLi," the measurement is contaminated — real intrusion targets don’t tell you their type

[Screen example — selection record]
Candidates: 17 unsolved Dreamhack difficulty 3–4 challenges
Random numbers: 7, 13, 2 → challenges A, B, C confirmed (titles only; type descriptions unread)

2-3. Conduct Rules — The 4 Hours and the Checklist Routine

Each challenge gets a 4-hour cap. Four hours is "one focused block of a day" — a realistic amount of time to invest in one vector during an actual pentest.

The route inside the time box is fixed.

0:00~0:30  Recon — open every page, parameter, cookie, and JS file; write a materials list
0:30~1:00  Hypotheses — write down three or four candidates for "what's blocking / what's being asked"
1:00~3:30  Experiments — eliminate bypass candidates per hypothesis in a table (no interference: no solution searching)
3:30~4:00  Wrap-up — if you broke through, verify by reproduction; if not, record where you got stuck

Allowed scope of research: reading technique documents (e.g., "a list of SQLi filter-bypass techniques") is allowed — meeting a technique you don’t know is not a skill shortage but a learning signal. What’s forbidden is the solution to that challenge. The boundary is clear: "learning a general technique" is allowed; "obtaining this challenge’s answer" is forbidden.

2-4. The Three Types of Stuck — Classified Failure Becomes Medicine

If you spent the 4 hours and still couldn’t solve it, classify the failure into three types.

Type	Symptom	Retraining address
Information shortage	You couldn’t find the materials (hidden parameter, JS file)	Review the recon routine (Steps 145, 199)
Technique shortage	You saw the materials but your hands didn’t move	Return to that technique’s chapter (Steps 135–150)
Execution error	The technique was right but the payload got tangled	Burp Repeater experiment drills (Step 133)

When an "unknown technique" shows up, learn it within the allowed research scope and retry. What matters is the classification — a classified failure becomes the table of contents for your next study session.

3. Follow Along

3-1. Before Starting — The Pledge and Preparation

Before you start, decide three things and write them at the top of your document.

[Screen example — check declaration]
- Selection method: 3 random draws from unsolved Dreamhack difficulty 3–4
- Rules: 4 hours per challenge, no solution searching, technique documents only
- Verdict: pass on 3 consecutive successes; on failure, classify the type and retry

You need this declaration to hold yourself steady when "just one little hint…" starts whispering. Keep a physical timer running.

3-2. Challenge 1 — Follow the Routine as Is (Screen Example)

Open the first challenge and start with recon.

[Screen example — recon record, first 30 minutes]
- Page: a board in the form /challenge/view.php?no=1
- Parameters: no (number), search (string), cookie sess
- JS: one file, check.js — only validates input length
- Hypotheses: ① SQLi on no ② XSS on search ③ sess cookie tampering

How to read it: the routine you’ve learned so far is all there is. You do nothing new. What the check measures is exactly this — "does the routine come out automatically?"

3-3. Hypothesis Elimination and the Breakthrough (Screen Example)

[Screen example — experiment record]
Hypothesis ① SQLi on no: 1 AND 1=1 / 1 AND 1=2 comparison → identical responses. Eliminated
Hypothesis ② XSS on search: <script> stripped, <img src=x onerror=> passes
  → but the goal is auth bypass. Lower priority
Hypothesis ③ sess cookie: base64 decode → {"user":"guest","exp":...}
  → re-encode user as admin → caught by signature check
  → there's a signature = the challenge is about defeating it. Move to the alg/secret layer

How to read it: the longer the failure record, the better the record. If every eliminated hypothesis carries a "why it wasn’t this," then at the breakthrough point the "why it was this" explains itself.

3-4. Judging Success — Verify by Reproduction

Getting the right answer isn’t the end. The verdict on an independent solve is reproduction.

From the top — reset the session and walk the same path alone again
Explain each step of the path in one line: "why this step?"
If your explanation stalls at any step, the challenge isn’t fully yours yet — look again

3-5. Handling Failure — Classification and Retry

The procedure when you exceed 4 hours.

Turn off the timer and take your hands off
Classify the stuck point into the three types and record it
Return to the retraining address and review that chapter
Exclude this challenge from valid records, draw a new one at random, and restart the three-peat

A failed challenge becomes a future exercise. Retry it in a week or two and you’ll feel how your hands have changed.

3-6. Environment Rules to Keep During the Check

For fair measurement, unify the environment too.

Block notifications: silence messenger and email alerts. An interrupted 4-hour block starts counting again from zero
Keep the record window open: always have the record document up next to the window where you type payloads. "I’ll write it down later" never gets written
Fix your tools: go with your usual Burp settings and browser. Don’t test new tools on check day — mixing tool variables blurs the measurement
Make the timer physical: run a separate, visible timer, not one in the corner of your screen. Let a device, not your memory, enforce the cap

3-7. After Three in a Row — Writing the Three Write-ups

Once you pass, write a write-up for each challenge yourself. This time it’s not someone else’s solution — it’s yours.

[Screen example — write-up format]
# Challenge OOO Write-up
- **Materials**: (what you found in recon)
- **Hypotheses & eliminations**: (the wrong paths and why)
- **Breakthrough**: (the steps that passed and the payload's structure)
- **Why this is the answer**: (an explanation from the server code's perspective)
- **One line learned**: (if none, write "none — routine confirmed")

The "why this is the answer" box is the heart of a write-up. Knowing a payload and understanding an answer are different things.

4. Missions & Exercises

Mission — Three Independent Solves in a Row

Randomly select three intermediate challenges per the 2-2 criteria and leave a selection record
Apply the 4-hour cap and the 2-3 routine to each challenge
Keep process records including hypothesis lists, attempted payloads, failure reasons, and breakthrough points
On three consecutive successes, write each challenge’s write-up in the 3-7 format
On failure, classify it into the 2-4 types and, after retraining, retry with a new challenge

Exercises

Exercise 1. From a measurement perspective, explain why challenges must be selected "randomly."

Exercise 2. Define in one sentence the boundary between research allowed during the check and research that is forbidden.

Exercise 3. Give an example of a situation that would be classified as "technique shortage" among the three types of stuck (information shortage, technique shortage, execution error).

Exercise 4. You failed on the 2nd challenge of a three-peat. List, in order, what to do next.

5. Model Answers & Completion Criteria

Mission Model Answer

The skeleton of a completed check record:

[Screen example — three-peat record table]
Challenge | Time spent | Type (identified after) | Breakthrough point              | Verdict
A         | 2h 40m     | cookie tampering        | signature algorithm confusion   | success (reproduced)
B         | over 4h    | (unconfirmed)           | stuck eliminating at search filter | failure → technique shortage
C         | 1h 15m     | SQLi                    | /**/ whitespace substitution    | success (reproduced)
D         | 3h 05m     | upload                  | extension mixing + path guessing | success (reproduced)
→ Streak reset by B's failure; three-peat achieved with C·D·(new E)

How to verify: ① was the selection random (a selection record exists)? ② does each success carry a reproduction procedure? ③ is "why this is the answer" filled in on each write-up? ④ if there are failures, are type classification and retraining addresses connected?

Exercise Answers

Answer 1. If you pick knowing the type, a large part of recon — the process of reading "what is this challenge asking?" — is handed to you as a gift, contaminating the measurement. Real targets don’t announce their type. Random selection is the condition for measuring "does the routine stand even before a challenge you’ve never seen?"

Answer 2. "Learning a general technique is allowed; obtaining this challenge’s answer is forbidden." Reading a filter-bypass technique document is learning a tool; searching a challenge number and viewing its solution is receiving the answer. Meeting an unknown technique is a learning signal, not a disqualification.

Answer 3. Example: you discovered a signed token and even identified the need to tamper with it, but couldn’t act because you didn’t know the signature-defeating technique itself. The materials (information) were found and the direction was right, but the toolbox lacked that tool — the retraining address is that technique’s chapter (in this example, the JWT attacks of Step 197).

Answer 4. ① Turn off the timer and take your hands off. ② Classify the stuck point into the three types and record it. ③ Return to the classified type’s retraining address and review. ④ Exclude the failed challenge from records, draw a new one at random, and restart the three-peat. It’s not "back to the start" — it’s "replacement with a new challenge."

Completion Criteria Checklist

[ ] I left a random-selection record (candidate range and random-number results)
[ ] I kept the 4-hour cap and routine (recon → hypotheses → experiments → wrap-up) on every challenge
[ ] My process records contain hypotheses, payloads, failure reasons, and breakthrough points
[ ] I used only technique documents and never looked at solutions
[ ] I verified every solved challenge by reproduction
[ ] Failures, if any, are linked to type classifications and retraining addresses
[ ] Mission: three-peat achieved + 3 write-ups completed

6. Common Pitfalls & Fixes

Wall 1. "Surely this much of a hint is fine" keeps bubbling up

Symptom: after about an hour stuck, your hand drifts to the search bar.
Cause: you’re mistaking the check’s purpose for a score. What’s measured here is your routine, not the site’s points.
Fix: keep the 3-1 declaration floating next to your screen. And record the urge itself the moment you’re stuck — "1:20, urge to search for the solution arose, resisted" is excellent measurement data.

Wall 2. The 4 hours evaporate

Symptom: you burn all your time clutching one hypothesis.
Cause: failed time allocation in the experiment phase. More than an hour on one hypothesis means your candidates have dried up.
Fix: give each hypothesis an internal cap of 30–40 minutes. An eliminated hypothesis is not a failure but a completed map. Once 3 hours pass, spend the rest on "wrap-up" as a rule.

Wall 3. I feel like I drew a challenge I know

Symptom: you open a challenge and remember seeing something similar.
Cause: sometimes you get spoiled reading community posts.
Fix: replace it honestly. If you judge that "I know the core trick," that challenge can’t be used for measurement. Leave "replacement reason: prior exposure" in the selection record and draw a new number.

Wall 4. My motivation snaps after the streak breaks

Symptom: you solve two, collapse on the third, and feel sent back to the beginning.
Cause: you’re thinking of the "streak" as stacking a tower. In reality it’s only a measurement reset — the skill has accumulated.
Fix: look at your records again. The process records up to the two-peat haven’t vanished, and the failure’s classification has become your next training address. The only thing that resets is the verdict counter.

Wall 5. The write-up ends up as "a list of payloads"

Symptom: the write-up has commands but no reasons.
Cause: in the excitement of solving, you moved on without writing the "why."
Fix: postpone writing to the day after the success. To re-explain the path a day later, you absolutely need "why this step." The box where your explanation stalls is exactly the box you don’t yet understand.

7. Summary

Today’s Concepts

Concept	One-line explanation
Independent solve	Cracking a challenge with technique documents only, no solutions
The three-peat rule	The starting point of the zone luck can’t explain
Random selection	A selection method that prevents measurement contamination
The three types of stuck	Information shortage / technique shortage / execution error — classification is the prescription
Reproduction verification	Success is judged by "walking it again alone"
Write-up	A document that lets others reproduce your thought path

Today’s Procedure

Step	What it does
Select	3 random draws from unsolved intermediate candidates
Conduct	4 hours per challenge, recon → hypotheses → experiments → wrap-up routine
Record	Hypotheses, payloads, failure reasons, breakthrough points
Verdict	Counted on reproduction success; void and replaced if a solution was viewed
Review	3 write-ups + failure-type classification and retraining

An Instinct More Important Than Commands

This check asks one thing — before a challenge nobody explains, do your hands move? The answer lies not in the three-peat itself but in the density of hypotheses and eliminations recorded on the way to it. And even if you fail, you lose nothing. A classified failure becomes a table of contents, and a reset counter climbs again. If you’ve passed this stretch, you’ve earned the right to walk out the Web track’s gate.

Once every box is checked, Step 202 is complete. Click the checkbox in the sidebar to save your progress.