Step 285. ★ CTF #4: The Weakness-Field Assault Competition — The Courage to Set Your Strengths Down for a While

Level 3 — The CTF Competition Cycle | Difficulty ★★★★☆ | Estimated time: 2 days (competition weekend + advance preparation)

Prerequisites: Step 284’s team meeting — the weakness field agreed, owners designated, and the focused study plan left in the minutes.

What you need: a weekend competition picked on CTFtime (ctftime.org), Step 284’s minutes, the weakness-field owner’s cheat sheet, the team board. Competition screens and result scenes are screen examples — the problems and scores of the competition you enter will naturally differ.
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. A CTF competition is a legal stage the organizers open for attacking their challenge servers; the competition infrastructure (scoreboard server, etc.) and other teams’ environments are not targets.
This chapter is a competition chapter — no new tools; the whole thing is one experiment called "competition operation that assaults the weakness head-on."

At the last meeting, the team confirmed its weakness in numbers, and the owner spent 2 weeks studying that field intensively. One question remains — does the study work in the field? This competition is the exam paper that measures the answer.

There is one strategic tension here. Banking points in your strong fields raises your ranking but leaves the weakness as-is; clinging only to the weakness collapses the score. Today’s solution is a time allocation rule agreed in advance — and this competition’s real goal is not ranking but "progress in depth of reach within the weakness field." Change the goal, and the hands that run the competition change.

1. Learning Objectives

By the end of this chapter, you will be able to:

Explain the principle of deliberate discomfort training and apply it to a competition
Design a time allocation rule that splits weakness assault from base-score securing
Turn one owner’s study into a team asset by sharing the cheat sheet in advance
Quantify growth by measuring "depth of reach" regardless of solves
Wrap up the post-competition retrospective with a "first flag" or "the next step needed"

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	CTFtime weekend competition (Jeopardy), team board, chat/screen sharing
Today’s command	None — the competition itself is the exercise. Advance deliverables are the cheat sheet and the allocation rule
Concepts needed	Deliberate discomfort training, time allocation rule (weakness 30%), depth of reach, paired attempts
Today’s deliverable	Competition log + depth-of-reach record + retrospective (first flag or next step)

2-1. Deliberate Discomfort Training — Comfortable Practice Doesn’t Raise Skill

Exercise physiology has the principle of deliberate practice — skill-raising practice happens only outside your current ability, at the uncomfortable spot. Re-solving problems you can already solve is maintenance, not growth.

Apply this principle to a CTF team and it reads like this — play the competition in your strong fields and points come out, but the team’s weight class stays the same. A competition assaulting the weakness head-on has poor point efficiency, but a single first flag redraws the whole team’s map: the moment that field changes from "land you can’t even touch" to "land worth spending time on."

Note that this training has an order. Step 284 meeting → owner’s focused study (2 weeks) → today’s live verification. Choosing discomfort without the study is not training — it’s just a losing competition.

2-2. The Time Allocation Rule — The Weakness 30% Principle

The most common failure of a weakness-assault competition is "getting absorbed in the weakness and missing the base score." So before the start, agree on the allocation of the team’s total time in numbers.

Use	Share	Content
Base score	60%	Main-field Easy~Medium — the ranking defense line
Weakness assault	30%	Owner + 1 pair fixed on weakness-field problems
Flexible reserve	10%	Swaps for stuck problems, endgame fire concentration

Why 30% of all numbers — past 50% the base score collapses and team morale wobbles; in the 10% range time runs out before one problem’s recon even finishes. 30% is the minimum time in which "a pair can seriously attach to 2–3 easy weakness problems." Adjust the ratio per team, but never change the format of agreeing in numbers — "a reasonable amount" always converges to zero mid-competition.

Understand the ratio’s meaning precisely — not "spend at most 30%" but "30% is spent on the weakness without fail." Even when no points come, that time is not reclaimed. Without this promise, mid-competition impatience devours the weakness-assault time, and the team once again plays "the competition of only doing what we’re good at."

2-3. Depth of Reach — Measured Even When Unsolved

Weakness-field problems are likely to go unsolved. So instead of the success/failure dichotomy, record depth of reach — which layer of the problem you penetrated to.

Layer	Standard (Web field example)
L0 unattempted	Never opened the problem
L1 understood	Identified what technique the problem demands
L2 reproduced	Tried the related technique’s attack locally / with tools
L3 close	Pinpointed the flag’s location/conditions — failed the last step
L4 solved	Flag submitted

This table’s power is in comparison against last time. "0 points again" and "last time L1, this time L3" are the same zero but completely different results. The assignment’s directive — measure depth of reach regardless of solves — is implemented with this table.

2-4. Cheat Sheet Sharing — Turning One Person’s Study into a Team Asset

What the owner studied for 2 weeks must be shared with the team as a one-page cheat sheet the day before the competition. Two reasons.

First, if the owner falls asleep or gets stuck mid-competition, another teammate can take over with the cheat sheet. Second, the act of writing the cheat sheet is itself the completion of learning — knowledge you can’t compress into one readable page is still hazy knowledge (the same principle as Step 278’s explainability).

The cheat sheet’s four cells: concept in one line / signals (signs that this problem is that type) / tools and commands / traps. The signals cell is the core. What a competition needs is not knowledge but "the eye that recognizes this problem as one of my cheat sheet’s problems."

3. Follow Along

3-1. The Day Before — Cheat Sheet Sharing and Allocation Rule Fixed

The owner posts the cheat sheet to the team channel and gives a 15-minute mini-briefing. Five minutes of reading, ten of Q&A is enough.

Screen example (part of a cheat sheet from a team that set weakness field = Forensics):

[Forensics cheat sheet — pcap edition]  owner: A
- concept: a pcap is a raw record of packets. The flag lives in plaintext protocols (HTTP/FTP)
- signals: a .pcap/.pcapng attachment + a problem statement saying "we dumped the network"
- tools: Wireshark → Statistics > Conversations, Follow > TCP Stream
       command line: tshark -r dump.pcap -Y "http" -T fields -e http.file_data
- traps: with hundreds of streams, filter first. Reading everything burns the clock

Then agree on the allocation rule. Write the allocation cells in advance on 3-3’s board format — agreements must be carved into a document to survive mid-competition.

3-2. The Start — The First 30 Minutes Are Recon

At the start, everyone sweeps the problem list. Two purposes — fixing the list of weakness-field problems, and assigning Easy problems for the base score.

Screen example (first recon result memo):

Competition board (22 offered):
- Web 5 / Pwn 4 / Crypto 4 / Reversing 4 / Forensics 5
- weakness field (Forensics) 5 problems: pcap-2(100), mem-artifact(200), disk-1(300), stego-mix(300), timeline(400)
- base-score candidates: Web Easy 2, Crypto Easy 2 → assigned to C and D
- weakness attempts: A(owner)+B(pair) → starting from pcap-2

How to read it: the weakness field came out heavier than expected (5 problems) — don’t get impatient. The goal is not solving them all but carving depth of reach starting from the easiest. Attempt in difficulty order, not point order.

3-3. Mid-Competition — Paired Attempts and Depth Recording

The weakness pair runs on three rules.

One screen, two people — the owner drives, the pair records. You may split research and coding, but judgments are made together.
Update depth every 30 minutes — write the current layer on the board, like "pcap-2: entered L2 (tshark filter complete, extracted 3 HTTP out of 300 streams)."
Cheat-sheet cross-check — at every stall, return to the cheat sheet’s "signals" cell and confirm this problem really is that type. Misreading the type is the most common time waste in a weakness field.

Screen example (depth records on the board):

14:00 pcap-2: L1 — plaintext HTTP confirmed. Matches cheat sheet type #2
15:00 pcap-2: L2 — TCP streams extracted, login POST found. Analyzing cookie encoding
16:00 pcap-2: L3 — flag condition pinpointed (admin session reuse). Cookie decryption failed
16:30 moving to mem-artifact — pcap-2 closed at L3

3-4. The Last 2 Hours — Rechecking the Allocation Rule

Two hours before the end, stop the whole team and ask — "did we keep the allocation rule?" If the 60% base score is secured, pour the 10% flexible reserve into the weakness field’s L3 problem. If it’s not secured — and that is this competition’s painful discovery — return the reserve to the base score.

The temptation to claw back weakness-assault time at the end always comes. Then re-read the minutes’ sentence — "this competition’s goal is not ranking but progress in depth of reach." Changing the goal mid-competition is contaminating the experiment.

3-5. Right After the End — The 30-Minute Retrospective

When the competition ends, retrospect before it cools. Only two questions.

Q1. Did the first flag come out?
  → if yes: what worked — which cell of the cheat sheet was decisive
  → if no: what was the highest depth of reach, and what is the next step
Q2. Was the allocation rule kept?
  → what did 60/30/10 actually come out as

Screen example (retrospective memo):

- No first Forensics flag. Highest depth: pcap-2 L3 (last time L1 → this time L3)
- Next step: session-cookie decryption — the "encrypted cookie" type is the wall. Step 288 boot-camp candidate
- Allocation measured: 55 / 25 / 20 — the reserve leaked to base score at the end. Next time, move the 2-hour check 1 hour earlier
- Conclusion: goal achieved (depth-of-reach progress confirmed). pcap-2 goes to debrief block A to be dug to the end

4. Missions & Exercises

Mission — Finish the Weakness-Field Assault Competition

Confirm the weakness field in Step 284’s minutes, and share the owner’s cheat sheet (4 cells) the day before the competition.
Carve the 60/30/10 allocation rule into the board before the start.
Attempt weakness-field problems as the owner + 1 pair, and record depth of reach (L0–L4) on the board every 30 minutes.
Two hours before the end, check allocation-rule compliance and decide the flexible reserve’s destination.
Right after the end, leave a "first flag or next step" sentence in the 30-minute retrospective.

Exercises

Exercise 1. How does deliberate discomfort training differ from "just clinging to a hard problem"? Answer from the perspective of preconditions.

Exercise 2. In the rule assigning 30% to the weakness assault, why must it be "30% without fail" rather than "at most 30%"?

Exercise 3. Give two ways recording depth of reach (L0–L4) beats the success/failure dichotomy.

Exercise 4. Why is the cheat sheet’s "signals" cell used more often mid-competition than the other cells (concept / tools / traps)?

5. Model Answers & Completion Criteria

Mission Model Answer

Check against these verification criteria.

The cheat sheet exists: was a one-pager with the 4 cells (concept / signals / tools / traps) filled shared before the competition — a cheat sheet made after the competition was not this competition’s tool.
Prior agreement of the allocation rule: is 60/30/10 written on the board before the start — a ratio estimated after the end is not a rule but an excuse.
Continuity of depth records: do 30-minute layer updates remain on the board — records written all at once after the end are reconstructions of memory with large error.
Trace of the endgame check: is the decision made at the 2-hour check (the reserve’s destination) recorded?
The retrospective is in sentences: is a "first flag" or "next step" left in at least one sentence — "too bad" is not a retrospective but an impression.

Exercise Answers

Answer 1. The precondition — whether prior study happened. Deliberate discomfort training is a structure of "preparing with focused study, then verifying live." Clinging to a hard problem without study is unprepared pain; no material of skill accumulates. For discomfort to be training, study must attach before it and a debrief after — discomfort is not the material but the exam.

Answer 2. Because mid-competition impatience will devour the weakness time without fail. "At most 30%" becomes 0% the moment score pressure arrives — humans are designed to flee to familiar problems. "30% without fail" institutionally blocks that flight. A training competition’s value is not points but expansion of the map, so guaranteeing that expansion time is the rule’s reason for existing.

Answer 3. First, progress against last time gets measured — "last time L1, this time L3" is 0 points but evidence of growth, indistinguishable under the dichotomy. Second, the next training gets coordinates — a record of stopping at L3 pinpoints "the last step’s technique," making the targets of the debrief and boot camp (Step 288) exact. The dichotomy’s zero doesn’t tell you what to fix.

Answer 4. Because the first decision at a competition is "what type is this problem." Concept, tools, and traps are only used after the type is confirmed; misread the type and the other three cells get spent on entirely the wrong problem. The signals cell is the cheat sheet’s table of contents and its safety lock — the cell that judges whether to even unfold the cheat sheet for this problem, so it’s used most often and first.

Completion Criteria Checklist

[ ] I shared the owner’s cheat sheet (4 cells) with the team the day before
[ ] I wrote the 60/30/10 allocation rule on the board before the start
[ ] I attempted weakness-field problems as the owner + 1 pair
[ ] I recorded depth of reach (L0–L4) on the board every 30 minutes
[ ] I checked allocation-rule compliance 2 hours before the end
[ ] I left a "first flag" or "next step" sentence in the retrospective
[ ] I confirmed the highest depth of reach advanced vs last time (or recorded why it stalled)
[ ] I handed unsolved weakness problems to debrief block A (Step 280 procedure)

6. Common Pitfalls & Fixes

Wall 1. Mid-competition, I want to abandon the weakness assault

Symptom: main-field points are flowing while the weakness pair is stalled at L2. The thought "if we spent that time on the main field…" starts.

Cause: without the depth-of-reach metric, weakness-assault time looks only like "zero-point time" — a normal impatience.

Fix: re-read the depth records on the board — "L1 → entered L2" is absent from the scoreboard but is an advance that actually happened. And re-check the sentence agreed before the start — this competition’s goal is not ranking but progress. Remembering the goal is the strength that keeps the rule.

Wall 2. The pair attempt became just watching the owner work alone

Symptom: the pair stares blankly at the screen. Doesn’t seem to help.

Cause: you only "watched together" with no role split. One screen and two people also needs roles to work.

Fix: split roles explicitly — the owner drives (tool operation), the pair records and asks questions ("what’s the current hypothesis?", "which cell of the cheat sheet?"). The pair’s questions aren’t interference but a device that makes the owner’s thinking audible. And the answers to those questions become the board’s depth records.

Wall 3. I made the cheat sheet but it never gets used at the competition

Symptom: the problem you opened was a type not on the cheat sheet, so you couldn’t touch it.

Cause: one of two things — the studied types and the offered types missed each other (luck), or the cheat sheet’s "signals" cell was empty so type recognition failed (skill).

Fix: if the latter, rewrite the cheat sheet — extract common clues from the problems solved during study and fill the signals cell with which clues announce this type. If the former, record it in the retrospective as "offering variance" and wait for the next competition — don’t overturn your study direction over one competition’s offerings.

Wall 4. The first flag came out of the weakness field, but the team’s mood is strange

Symptom: only the owner is elated; the rest wear "we did nothing" faces.

Cause: the weakness assault got framed as the owner’s personal achievement. In reality, the meeting (284) set the direction, the pair recorded, and the main team held the 60% — that’s what made it possible.

Fix: split the credit explicitly in the retrospective — "this flag’s starting point was the last meeting’s weakness judgment." In a team sport, the goal belongs to the scorer but the win belongs to the team. If you don’t set this culture, nobody volunteers as the next weakness owner.

Wall 5. We kept the allocation rule and our ranking dropped a lot

Symptom: the ranking fell below last time, and a teammate voices complaint.

Cause: you didn’t distinguish a training competition from a results competition. A weakness-assault competition has low point efficiency by design — that is this competition’s cost and its price.

Fix: recall Step 283’s goal setting — this competition’s behavior goal was "depth-of-reach progress in the weakness field," and ranking was not a goal. Ranking goals are pursued on stages designated as results competitions, like Step 289’s midterm evaluation competition. A team that plays every competition as a results competition stops growing — deciding "what is this stage for" at every competition is the core of team operation.

7. Summary

Today’s Concepts

Concept	One-line explanation
Deliberate discomfort training	A structure that verifies a study-prepared weakness live — different from unprepared pain
Time allocation rule	Base 60 / weakness 30 / reserve 10 — an institution that guards training time from impatience
Depth of reach (L0–L4)	Layers from unattempted to solved — a ruler that measures the advance inside zero points
Paired attempt	Owner + 1, driving/recording split — the unit that turns one person’s study into a team asset
Cheat sheet 4 cells	Concept / signals / tools / traps — the signals cell is the safety lock of type recognition
Training vs results competition	Decide the stage’s purpose in advance — playing every competition for results stops growth

Today’s Tools & Formats

Tool/format	What it does
Cheat sheet (one page)	Turns the owner’s 2 weeks of study into a tool the team uses
Allocation rule table	The promise to return to when judgment wobbles mid-competition
Depth-record board	30-minute layer updates — turning zero-point time into advances
Retrospective 2 questions	First flag or next step + allocation-rule compliance

The Instinct Beyond Commands

At today’s competition, you chose discomfort. Leaving the easy road of banking points with your strengths, you walked into the blank on the map. At the end of that discomfort may have been a first flag, or the L3 wall — both are harvest. If the wall’s position was recorded exactly, the next boot camp (Step 288) just heads for those coordinates.

And one more thing — the difference between a team that has run a weakness-assault competition and one that hasn’t lies in attitude before skill: the self-awareness "we are a team that can test what we can’t do." This is the real asset on the road to the midterm evaluation competition (Step 289).

Once every box is checked, Step 285 is complete. Click the checkbox in the sidebar to save your progress.