Step 299. Qualifier Speed Training: 10-Problem Time Attack — The Technique of a Pace That Sweeps Easy Problems First

Level 3 — Real-World CTF & Advanced Offensive Skills | Difficulty ★★★★☆ | Estimated time: 2 days (8-hour 10-problem time attack + results analysis)

Prerequisites: you’ve finished Step 298’s domestic past-exam solving and trend-analysis table. This chapter is a simulation that builds the "pace" of qualifier day.

What you need: 10 mixed-field problems (past exams or similar, easy-to-medium difficulty), a timer, a per-problem record form, and a Python aggregation script. Solving scenes on external platforms are marked as screen examples.
Caution: today is not the day of "solving precisely" but the day of "sweeping fast and precisely." Not one problem’s perfect solution but the allocation across 10 problems is what gets evaluated.
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. Use only past exams and similar problems that operators have published.

A qualifier is a game of solving as many problems as possible inside a time limit. And what draws this game’s cutoff line is not one hard problem but how fast and accurately you swept up the easy problems. The difference between top teams and mid teams is mostly decided by "did you miss any problem you could solve."

But this ability doesn’t come from knowing about it. Choosing the order of problems under time pressure, dropping what stalls, reducing wrong answers — all of it must be a routine embedded in your body. Today we simulate a 10-problem consecutive solve with the clock running, exactly like a real qualifier, to build that routine.

1. Learning Objectives

By the end of this chapter, you will be able to:

Design a mixed-field 10-problem set matching the qualifier format
Build and execute an "easy-first full sweep" order strategy and a time budget table
Maintain a log habit of recording per-problem start/finish/wrong submissions in real time
Reassess remaining problems and adjust the order at the mid-reassessment point (3 hours elapsed)
Compute score rate and time efficiency with an aggregation script, and debrief strategy with a "what if the order changed" simulation

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	Past-exam/similar-problem platforms (legally published), a timer, notepad or spreadsheet, Python 3
Today’s commands	No new commands — all problem-solving commands are review; aggregation is a local Python script
Concepts needed	Full-sweep strategy, time budgets, opportunity cost (the cost of a stuck problem), the cost of wrong answers, mid-reassessment
Today’s deliverable	Time-attack log + aggregation results + "what if the order changed" simulation memo

2-1. The Qualifier’s Game Structure — The Cutoff Is Set by Total Score

Domestic competition qualifiers usually open dozens of problems over about 8 hours. Points differ per problem, and many competitions use dynamic scoring (a problem’s point value drops as more teams solve it). So the strategic axis is simple — always solve what others solve (miss it and you fall behind on point defense), and add one problem others couldn’t solve.

"What others solve" means exactly the easy-to-medium problems. In other words, the qualifier’s first contest is the complete capture of easy problems, and the purpose of speed training is building the pace to finish that complete capture inside the time limit.

2-2. Easy First, Full Sweep — Order Is Score

The time attack’s basic strategy has three stages.

Full sweep (15–20 min): skim every open problem — title, field, points. Judge only "can I see an immediate solve?" — don’t start solving.
Sweep up from the easy: clear problems that show an immediate solve, lowest points first. The goal of this stretch is not speed but zero mistakes.
Attack in point order: take the remaining problems in descending point order, with a per-problem time cap (the budget table below).

Invert this order — latch onto a high-point problem from the start — and you get the worst picture: 3 hours spent, 0 points. Order is not preference; it is strategy determined by the score structure.

2-3. Time Budget — Fix the Cap on Stalls in Advance

A time-budget example for an 8-hour (480-minute) time attack.

Phase	Time	What to do	Notes
Full sweep	0:00–0:20	Read all problems, fix the order	No solving — judgment only
All low-point problems	0:20–2:00	Every 100–200 pt problem	Goal: zero mistakes
Mid-reassessment	3:00–3:10	Reassess remaining problems, adjust order	Clock-based, not problem-count-based
High-point attack	2:00–6:30	Descending points, 90-min cap per problem	On cap breach, mark and switch
Wrap-up	6:30–8:00	Organize solves, re-verify flag formats, finish unsubmitted work	No starting new problems

The core is the per-problem time cap. Attach to a problem with no cap and one problem swallows the whole competition. A problem you switch away from at the cap is not "dead" but "on hold" — after finishing the high-point rounds, you come back if time remains.

2-4. The Cost of Wrong Answers — The Flag-Format Check Routine

A point from the source material — flag typos and format mistakes quietly shave off points. A wrong submission costs three things.

Time: the minutes lost to re-checking and resubmitting
Penalty: some competitions deduct points per wrong submission — always read the rules before starting
Rhythm: the mental cost of returning to a problem you "thought was right"

So attach a 10-second pre-submit routine to your body: ① confirm the competition’s flag prefix (it differs per competition — flag{}, CTF{}, CODEGATE{}, etc.), ② strip leading/trailing spaces and newlines, ③ compare character by character against the screen instead of trusting the copy. These 10 seconds are the cheapest scoring equipment in today’s training.

3. Follow Along

3-1. Designing the Problem Set — A Miniature Qualifier

Pull out the posing-trend analysis table you organized in Step 298. Pick 10 problems in those proportions — if Web was 30% of the qualifier, the set gets 3 Web problems. Composition example (screen example):

Mixed-field 10-problem set (2200 points total)
Crypto    100 warmup-caesar    / 200 xor-repeating   / 300 rsa-smalle
Web       100 robots-txt       / 200 cookie-role     / 400 ssti-note
Forensics 100 exif-hidden      / 300 pcap-login
Pwn       200 ret2win-basic
Rev       300 crackme-serial

How to read it: limit difficulty to easy–medium. This training’s purpose is not breaking high difficulty but a pace that recovers every point near the cutoff line, so composing mostly of "types I know" that you’d actually meet in a qualifier is the right answer. Practicing unknown types is boot-camp time’s job.

Write the selection criteria down in one line — "the proportions of the qualifier trend-analysis table + what I can solve within 90 minutes." Without this criterion, the set becomes just a collection of problems you like.

3-2. The Log Form — Without Records, It’s Not Training but a Game

Before starting the timer, open the record form. One line per problem, five cells.

Problem | Field | Points | Start time | Finish time | Wrong submissions

Two rules for real-time recording. Write only at start and at finish (the recording itself must not eat time). +1 the wrong count immediately after each wrong submission (counting from memory later always drops some).

This form is the core deliverable of all of Step 299. Eight hours of solving blurs after a day, but this table becomes the aggregation script’s input and stays analyzable forever.

3-3. Running the Time Attack — The 3-Hour Reassessment Decides the Match

Set the timer to 8 hours and start. Fix the order in the 0:00–0:20 full sweep, then sweep from the low-point problems. The solving itself is exactly what you’ve honed across twelve competition cycles — what’s new today is allocation.

At 3:00, stop the problem in progress and reassess for 10 minutes. Screen example:

[3:00 mid-reassessment] (screen example)
Solved: 100x3 + 200x2 = 700 pts (all low-point problems done)
In progress: pcap-login (300 pts, 42 min in) — Wireshark filter set, but credential extraction failing
Remaining: crackme-serial (300), rsa-smalle (300), ssti-note (400)
Decision: mark pcap-login on hold -> switch to crackme-serial (a confident type)
          rsa-smalle goes last (uncertain for its time cost)

How to read it: the reassessment asks one question — "does the next 30 minutes on the problem in progress have a higher expected score than 30 minutes on another problem?" The fact that you already spent 42 minutes on pcap-login is not grounds for the decision. Time already spent never returns (sunk cost); only the coming 30 minutes is a resource.

3-4. Aggregation — Seeing Numbers, Not Feelings, with a Script

After finishing, feed the log to the aggregation script. Below is the aggregator’s core logic (step299_tally.py — replace the table inside the script with your own log).

Input (part of step299_tally.py)

@dataclass
class Attempt:
    name: str        # problem name
    cat: str         # field
    pts: int         # point value
    start_min: int   # start time (minutes from competition start)
    end_min: int | None  # finish time. None means unsolved
    wrong: int       # wrong flag submissions

python step299_tally.py

=== 10-problem time attack aggregation (480-min limit) ===
[O] warmup-caesar   Crypto    100pts   18min  wrong 0  (5.6pts/min)
[O] robots-txt      Web       100pts   23min  wrong 1  (4.3pts/min)
[O] exif-hidden     Forensics 100pts   25min  wrong 0  (4.0pts/min)
[O] xor-repeating   Crypto    200pts   39min  wrong 0  (5.1pts/min)
[O] cookie-role     Web       200pts   47min  wrong 2  (4.3pts/min)
[O] ret2win-basic   Pwn       200pts   76min  wrong 0  (2.6pts/min)
[X] pcap-login      Forensics 300pts   ---   wrong 1
[O] crackme-serial  Rev       300pts   86min  wrong 0  (3.5pts/min)
[X] rsa-smalle      Crypto    300pts   ---   wrong 0
[O] ssti-note       Web       400pts  138min  wrong 1  (2.9pts/min)
----------------------------------------------------
Solved 8/10  score 1600/2200 (73%)
Wrong submissions total 5  time used 452min (28min remaining)
By field: Crypto 300/600  Web 700/700  Forensics 100/400  Pwn 200/200  Rev 300/300
Unsolved: pcap-login (300pts), rsa-smalle (300pts)

(Measured 2026-09-09 — local script run result. The problem log is a fabricated sample.)

How to read the output: look at three lines. ① Score rate 73% — above the 60% completion bar. ② The by-field line — Web/Pwn/Rev are perfect while Forensics is 100/400. Not a skill issue but an allocation issue (time spent on pcap-login, then held). ③ The pts/min column — ssti-note was the most expensive at 2.9 pts/min but brought home 400 points, a justified investment. The numbers show a picture your gut couldn’t see.

3-5. "What If the Order Changed" — Change Just One Assumption

The final analysis. Looking at the log, set one assumption: "what if, at the 3-hour reassessment, I had kept grinding pcap-login instead of holding it?" Estimate the time solving pcap-login would have needed within the remaining 180 minutes. Screen example:

[Assumption] If pcap-login had continued (screen example)
Estimate: +60 min to credential extraction, 102 min total invested -> solve probability 50/50
Opportunity cost: those 60 min make crackme-serial (86 min) impossible -> -300 pts
Conclusion: expected value -150 pts — the hold decision was correct

How to read it: this simulation’s purpose is not regret but validating the decision rule. If "holding was right" is confirmed, the rule goes into the qualifier strategy document; if wrong, you fix the rule. Either way, the next competition’s strategy gets stronger — this is speed training’s final process.

4. Missions & Exercises

Mission — Complete the 10-Problem Time Attack and Its Aggregation

Design a mixed-field 10-problem set following the proportions of Step 298’s trend-analysis table (write the total point value and the one-line selection criteria).
Adjust 2-3’s time budget table into your own version, then run the 8-hour time attack — the full sweep and the 3-hour reassessment are mandatory.
Record per-problem start/finish/wrong submissions in real time.
Compute score rate, per-field score, and pts/min with the aggregation script.
Run the "what if the order changed" simulation with one assumption and fix one decision rule into a sentence.

Exercises

Exercise 1. From the perspective of how point values move, explain why the "easy-first full sweep" strategy is especially effective in dynamically scored competitions.

Exercise 2. When setting a per-problem time cap, besides "this problem’s remaining value," what must you always compare it against? Answer with the reassessment question from 3-3 as your basis.

Exercise 3. List the three costs of a wrong submission, and map which of them the 10-second pre-submit routine reduces.

Exercise 4. In 3-4’s aggregation, Forensics came out at 100/400. Using other numbers in the table as evidence, explain why this may not mean "insufficient Forensics skill."

5. Model Answers & Completion Criteria

Mission Model Answer

Check against these verification criteria.

Grounds for set design: do the 10 problems’ field proportions correspond to Step 298’s trend-analysis table, with the "one-line selection criteria" written down?
Existence of the budget table: was a time budget — full sweep, mid-reassessment, per-problem cap — fixed before starting? A budget made mid-attack is not a budget but an excuse.
Log completeness: are start/finish/wrong recorded for all 10 problems? A log filled with zero wrong submissions deserves suspicion of recording omissions.
Aggregation and decision rule: score rate 60% or higher (the completion bar), and is the decision rule fixed from the simulation a "condition → action" sentence? Example: "on breaching the 90-min cap → mark on hold and move to the next point-value problem."

Exercise Answers

Answer 1. In dynamic scoring, a problem’s point value drops as more teams solve it. Easy problems get solved by most teams, so solving them late or missing them means either ① receiving the deflated points late, or ② getting 0 outright — a relatively large gap opens. Hard problems, conversely, have few solvers so their value holds, and attacking them later costs little. So early complete capture of easy problems is not a personality trait but a point-defense strategy.

Answer 2. The expected score of spending the same 30 minutes on another problem — opportunity cost. 3-3’s reassessment question — "does the next 30 minutes on the problem in progress have a higher expected value than 30 minutes on another problem?" — is exactly that comparison. Time already spent (sunk cost) does not enter the comparison, because a resource that never returns cannot be grounds for a decision.

Answer 3. The costs are ① time (re-checking and resubmitting), ② wrong-answer penalty deductions, ③ rhythm collapse (returning to a problem believed solved). The 10-second routine — prefix check, whitespace strip, character-by-character comparison — prevents "format-level wrong answers," the common root of all three costs, so it reduces all three. Especially in competitions with penalties, it is the only equipment that directly blocks deductions.

Answer 4. In the table, Forensics’ only unsolved problem is pcap-login, and the same field’s exif-hidden was solved in 25 minutes with 0 wrong. Also, pcap-login was a problem strategically set aside as "on hold" at the reassessment — not a problem gripped to the end and failed. In other words, whether the low score’s cause is "couldn’t solve" or "didn’t solve by allocation" is distinguished by the start times and switch records — without this distinction, you’d misdirect the debrief toward skill reinforcement.

Completion Criteria Checklist

[ ] I designed a 10-problem set matching the trend-analysis table’s proportions, with selection criteria
[ ] I fixed a time budget table — full sweep, per-problem cap, wrap-up phase — before starting
[ ] I executed the 3-hour reassessment during the 8-hour time attack and recorded whether the order changed
[ ] The per-problem start/finish/wrong log was completed in 10 lines
[ ] I computed score rate, per-field, and pts/min with the aggregation script
[ ] I achieved a score rate of 60% or higher (if below, analyze the reassessment records and retry once)
[ ] I fixed one decision rule into a sentence via the "what if the order changed" simulation

6. Common Pitfalls & Fixes

Wall 1. I start solving the first problem during the full sweep

Symptom: "this one looks instantly solvable" — and the 15-minute sweep becomes a 1-hour solve.

Cause: a misunderstanding of the full sweep’s purpose — the sweep is not solving but order determination.

Fix: use a hands-off-the-keyboard rule during the sweep. For each problem, write only three letters’ worth — instant/ponder/hold — and close it. The problems judged "instant" are your first prey right after the sweep — only when the sweep ends does the whole map appear, and the first problem at that moment is the real first problem.

Wall 2. I set per-problem caps but can’t keep them

Symptom: "I’m almost there" — and the cap slips by 20, then 40 minutes.

Cause: the almost-done feeling is CTF’s most common illusion — problems exist where the last 10% takes 90% of the time.

Fix: enforce caps with a timer — when you start a problem, set an alarm for its cap time. When the alarm rings, unconditionally mark "on hold" and switch. If you really were almost done, come back in leftover time after the high-point rounds — holding is not giving up but reordering.

Wall 3. I found the right flag but submission keeps failing

Symptom: the content is clearly right, yet Incorrect flag repeats.

Cause: almost always format — the prefix differs from the competition’s rules, the copy picked up surrounding spaces/newlines, or you misread braces/underscores inside the flag.

Fix: run 2-4’s 10-second routine. If it still fails, re-read the problem page’s flag-format notice — it differs per competition. Having this experience in today’s training is luck. Record it in the wrong-answer log as a format mistake, and on qualifier day the same trap gets filtered in 10 seconds.

Wall 4. Sitting for 8 hours, my focus collapses in the back half

Symptom: from hour 5–6, you’re blankly staring at the same output.

Cause: a qualifier is also an endurance sport — 8 hours of focus doesn’t come without training.

Fix: put rest in the budget too — print 10-minute breaks every 2 hours (water, stretching, eyes off the screen) into the budget table. Recording breaks as part of the strategy lets you rest without guilt. And eat light — fullness is focus’s enemy.

Wall 5. My score rate couldn’t break 60%

Symptom: you worked hard but fell below the bar.

Cause: one of two things — the set was harder than your level (a design problem), or allocation collapsed (a strategy problem).

Fix: distinguish with the aggregation table. If pts/min is low overall and even low-point problems stalled, it’s a design problem — rebuild the set one difficulty notch down. If easy problems were fast but one or two problems swallowed the time, it’s a strategy problem — fix cap enforcement (Wall 2) and retry. Falling short is not failure but design data for the next set.

7. Summary

Today’s Concepts

Concept	One-line explanation
Easy-first full sweep	The basic qualifier strategy: set order in the sweep, then recover low-point problems with zero mistakes
Time budget	The pre-set allocation table of sweep/reassessment/per-problem cap/wrap-up — made midway, it’s not a budget
Per-problem cap	The alarm that stops one problem from swallowing the competition — on breach, "hold" and switch
Sunk cost	Time already spent is not decision grounds — comparisons are always between "next 30 minutes"
Mid-reassessment	Ten minutes at the 3-hour mark — recompute remaining problems’ expected values and adjust order
Cost of wrong answers	Time + penalty + rhythm — the 10-second pre-submit routine is the cheapest defense

Today’s Tools & Forms

Tool/form	What it does
Problem log form (5 cells)	Real-time record of start/finish/wrong — the aggregation’s input
Time budget table	An execution plan that splits 8 hours into phases
`step299_tally.py`	Log → score rate / per-field / pts/min aggregation
"What if the order changed" simulation	A debrief that validates a decision rule with one assumption

The Core Instinct

What speed training grows is not the speed of your hands but the speed of your judgment. Deciding "continue/hold" within 3 seconds of stalling, running the 10-second routine instead of panicking at a wrong answer, resting without guilt while watching the clock — the sum of these small judgments is the qualifier’s total score.

And remember — today’s aggregation table becomes qualifier day’s strategy document. Sentences like "I recover one low-point problem every 25 minutes" and "my score actually rises when I switch at the 90-minute cap" are your strategy, written in data rather than gut.

Once every box is checked, Step 299 is complete. Click the checkbox in the sidebar to save your progress.