Step 301. CTF Debrief Blocks A + B: The Final Reinforcement — Sealing the Leaks and Building the Battle Pack

Level 3 — Real-World CTF & Advanced Offensive Skills | Difficulty ★★★☆☆ | Estimated time: 2 days (competition #11 debrief + full-season re-read + sealing training)

Prerequisites: the debrief-block routine from Steps 280–300 (block A: dig unsolved problems to the bottom, block B: Write-up authoring) and competition #11’s log. This chapter is the final debrief of the twelve-cycle season.

What you need: competition #11’s log and the fixed qualifier strategy document (read-only), the whole season’s debrief notes, and your cheat sheets, playbook, and code library.
Caution: from today, new techniques are forbidden. Points right before a qualifier come from "accurate execution of what you already know" — today’s task is sealing the leaks, not expanding.
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. For similar-problem training, use only materials operators have published.

This is the last of twelve debrief cycles. If the debriefs so far were time spent "growing skill," this debrief is time spent "plugging where skill leaks out." Not stacking more on top, but keeping what you know from escaping at the exam hall — that is the essence of final reinforcement before the qualifier.

Today we finish competition #11’s debrief, take one last pass through the season’s debrief notes to seal the remaining holes, and complete the battle pack you’ll carry into the qualifier. And one important closing criterion — it doesn’t have to be perfect. Not filling every remaining hole, but sealing the most frequently leaking holes first is today’s right answer.

1. Learning Objectives

By the end of this chapter, you will be able to:

Debrief competition #11 with the block A (dig unsolved problems to the bottom) and block B (Write-up) routines
Re-read the whole season’s debrief notes to build a final list of "repeatedly missed" items
Order the sealing sequence by the priority criteria (frequency × recovery cost)
Execute 30-minute sealing drills per item (cheat-sheet re-check + 1 similar problem)
Organize the playbook/library/cheat sheets into the qualifier-day battle pack

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	Debrief notes, the Write-up repository (blog/GitHub), cheat sheets, code library, a timer
Today’s commands	No new commands — everything is debriefing and organizing work
Concepts needed	Sealing (plugging, not filling), frequency × recovery cost, the 30-minute sealing drill, the battle pack, the closing criterion
Today’s deliverable	Competition #11 Write-up + final repeated-miss list + sealing records + battle pack

2-1. Why Not New Things — Why Accuracy

Let’s compute what happens if you learn a new technique in the 2 days before the qualifier. The probability that the new technique appears in the qualifier is low, and even if it appears, a 2-day-old understanding won’t solve it under pressure. The accuracy of techniques you already know, by contrast — flag formats, a single command option, a restore procedure — intervenes in the score of every single problem.

The source material’s sentence is today’s principle: "In the qualifier, points come from accurate execution of what you already know." When the temptation of a new technique rises, repel it with this sentence. That temptation is not a love of learning — it is anxiety under another name.

2-2. Priorities — Frequency × Recovery Cost

Re-reading the whole season surfaces several "repeatedly missed" items. There’s no time to seal them all, so score them on two axes.

Item	Frequency (times this season)	Recovery cost (sealable in 30 min?)	Priority
JWT alg confusion verification procedure	3x	Low (check cheat-sheet procedure)	1
Padding-oracle script parameters	2x	Low (reinforce library comments)	2
Heap chunk structure diagram	2x	High (needs half a day)	4
Windows event-log filter	2x	Low (save query snippet)	3

How to read it: frequency is a proxy for "probability of meeting it again in the qualifier," and recovery cost is an indicator of "can I seal it now." Highest frequency and lowest cost first — that is the sealing order. A high-cost item like heap chunks is not sealed; it gets an avoidance strategy instead: one line in the strategy document’s margin — "if it appears, check the points and make it a hold candidate" — is enough.

2-3. Designing the 30-Minute Sealing Drill

One sealed item takes exactly 30 minutes. The composition is fixed.

Cheat-sheet re-check (10 min): find that item’s procedure in the cheat sheet and reinforce the one line where you stalled.
One similar problem (15 min): solve one very easy problem of the same type — not to learn something new but to verify the cheat sheet actually works.
Sealing record (5 min): leave one line — "what was blocked, and which line of the cheat sheet blocks it."

If it passes 30 minutes, that item is not a sealing target but a learning target — defer it past the qualifier. This time cap is the dike that protects today.

2-4. The Closing Criterion — It Doesn’t Have to Be Perfect

Where to set the end of today’s work matters as much as the work itself. The closing criterion is three sentences.

Seal the repeated-miss list from the top — not everything, from the top down.
Handle every unsealed item with one avoidance-rule line — done when no item is left unhandled.
Spend remaining time not on new reinforcement but on rest and re-running inspections.

Distinguish: the declaration "it doesn’t have to be perfect" is not a license for neglect. This criterion forbids exactly one thing — an item left with no decision at all. Seal it, write an avoidance rule, or defer it past the qualifier: once every item carries an owned decision, today is complete. What gets closed is not skill but undecidedness.

2-5. The Battle Pack — What You Carry In on Qualifier Day

When sealing is done, gather every asset into one folder. This is the battle pack.

battle-pack/
  playbook/      the penetration playbook + qualifier final strategy document (read-only)
  cheatsheets/   per-field cheat sheets (today's reinforced latest versions)
  library/       exploit templates, frequently used scripts
  checklist/     competition start routine, the 10-second pre-submit routine, inspection lists
  contacts/      team channel invite link, role-assignment sheet

One criterion — on qualifier day, will you never need to look outside this folder? If you can see something you’d go searching for, put it in the folder now. The battle pack’s completeness shows up as calm in the first 10 minutes after the competition starts.

3. Follow Along

3-1. Competition #11 Debrief — The Last Run of Blocks A and B

Following Step 280’s block A routine, pick at most 3 unsolved problems from competition #11 and dig them to the end. The selection criteria match 2-2’s table — most-likely-to-reappear-in-the-qualifier first. Screen example (debrief record):

[Competition #11 debrief — block A] (screen example)
Target 1: heap-note (Pwn, 400 pts) — the problem held during the competition
  Answer path: tcache count manipulation -> overwrite (checked against public Write-ups)
  Where I stopped: drawing the chunk structure, got confused tracking state after free
  Sealed? Learning target (exceeds 30 min) -> moved to post-qualifier tasks, avoidance rule confirmed in strategy doc
Target 2: backup-zip (For, 200 pts) — solved, but took 30 minutes
  Answer path: ZIP known-plaintext attack — one line of bkcrack finishes it
  My detour: 25 minutes of manual header analysis
  Sealed: added a bkcrack line to the cheat sheet's 'encrypted ZIP' section (sealed within 30 min)

How to read it: notice the two targets are handled differently. Not every competition failure gets sealed — seal only what seals in 30 minutes, and explicitly defer the rest. The decision to "defer" must also be recorded, so a deferred item is distinguishable from a forgotten one.

3-2. Block B — Writing the Competition #11 Write-up

Among the solved problems, pick one worth giving to others and write its Write-up. Use Step 278’s 8-section skeleton as-is. This block B adds one rule — check the season’s cumulative count. The cumulative totals of competition retrospectives and Write-ups are eligibility conditions for the Level 3 comprehensive evaluation (Step 303), so record what the count becomes with today’s writing.

[Write-up counter] (screen example)
Competition #11 Write-up: 1 written -> cumulative 51
Competition retrospectives: 11 through #11 (#12 to be written after the qualifier)

3-3. The Season Re-Read — Final List of Repeated Misses

Now skim the debrief notes of all twelve cycles. The purpose is not nostalgia but extraction — pick out only failures that appeared twice or more and build the list. Miss once and it’s a mistake; miss twice and it’s a structure. Screen example:

[Final repeated-miss list] (screen example)
1. JWT verification procedure — time lost at #4, #7, #11 (frequency 3)
2. Padding-oracle script parameter confusion — #6, #9 (frequency 2)
3. Windows event-log filter query — #8, #11 (frequency 2)
4. Heap chunk structure — #9, #11 (frequency 2, high recovery cost -> avoidance strategy)

How to read it: don’t be discouraged that this list is short — if twelve cycles of debriefing did their work, repeated misses should have shrunk. An empty list is evidence that "the debriefs worked well"; in that case, spend today re-reading the cheat sheets end to end and organizing the battle pack.

3-4. Running the Sealing Drills — With a Timer

Starting from priority 1 of the list, run 30-minute sealing drills. Screen example (item 1):

[Sealing drill: JWT alg confusion] (screen example)
10:00 cheat-sheet re-check — read the 4-step verification procedure in the 'JWT' section,
      reinforced step 3 (check the alg field) with "both none/HS256 confusion cases"
10:10 one similar problem — re-solved a JWT basics wargame problem, 9 min
      confirmed it proceeds per the cheat-sheet procedure (verification passed)
10:25 sealing record — "block: saw alg and skipped checking the key type.
      Cheat-sheet step 3 now enforces that order"
10:30 done. Next item tomorrow (cap of 2 per day)

How to read it: note the "cap of 2 per day." A sealing drill is verification, not study, so run back-to-back and the 15-minute similar problem degrades into an hour of digging. Four items in 2 days — enough to consume the top of the list.

3-5. Final Battle-Pack Organization and the Team Final Inspection Meeting

Gather the reinforced cheat sheets and the organized library into 2-5’s structure, and share the pack’s location in the team channel. Then hold a short final inspection meeting (30 minutes). Agenda screen example:

[Team final inspection meeting agenda] (screen example)
1. Battle-pack share — did everyone receive the same cheat-sheet versions (5 min)
2. Read-aloud of the qualifier strategy document — verbal confirmation of roles and communication protocol (15 min)
3. Day-of logistics — assembly time, channel setup, backup contact tree (10 min)

How to read it: item 2’s "verbal confirmation" matters — each reading the document alone and confirming the same clauses out loud together are different things. Have each person say the sentences in their own voice — "I’m Web first; if stuck, one line in the channel." Only clauses spoken aloud work on the day.

4. Missions & Exercises

Mission — Complete the Final Reinforcement

Select competition #11’s unsolved problems by 2-2’s criteria, perform block A debriefing, and decide per item whether to seal.
Write one Write-up as block B and update the cumulative counter.
Re-read the whole season’s debrief notes to build the final repeated-miss list (frequency 2+) and assign priorities.
Run 30-minute sealing drills from the top of the list (cap of 2 per day, sealing records required).
Complete the battle pack in 2-5’s structure and hold the team final inspection meeting.

Exercises

Exercise 1. From the perspectives of posing probability and accuracy, explain why learning a new technique right before the qualifier is a loss.

Exercise 2. Among the priority axes (frequency × recovery cost), what is the correct handling of an item with "high frequency but high recovery cost"?

Exercise 3. In the 30-minute sealing drill, why is solving a similar problem called "verification" rather than "practice"?

Exercise 4. Explain why the battle pack’s completion criterion ("on the day, will you never look outside this folder?") leads to day-of calm.

5. Model Answers & Completion Criteria

Mission Model Answer

Check against these verification criteria.

Block A’s selective sealing: were targets chosen by the criteria (frequency, cost) rather than debriefing every unsolved problem, with seal/defer decisions recorded per item? "Debriefed everything" is a deduction by today’s standards — it means you didn’t select.
Frequency notation on the list: does each repeated-miss item carry its frequency (at which competitions)? A list without sources is a list of memory, not of records.
The sealing record’s form: is there the one line of "what was blocked and which cheat-sheet line blocks it"? If there’s only a re-solving record with no cheat-sheet change, that’s not sealing but re-solving.
The pack’s self-sufficiency: are 2-5’s five folders filled, and did every team member confirm the same versions at the meeting?

Exercise Answers

Answer 1. The probability of a new technique appearing in the qualifier is low, and even if it appears, a 2-day-old understanding won’t solve it in the field — between having learned something and being able to solve with it lies repeated training. Accuracy improvements, by contrast, act across every problem — fewer mistakes in submission formats, procedure order, and restore methods raise the expected score across the whole set. Comparing expected values, a new technique is a narrow and uncertain gain; accuracy is a broad and certain gain.

Answer 2. Don’t seal it; leave it as an avoidance strategy. High recovery cost means today’s 30 minutes can’t plug it, and forcing the dig eats other items’ sealing time. Instead, write one avoidance-rule line in the strategy document — "if it appears, hold candidate" — deciding in advance the action for the day you meet it. Explicitly handling what you couldn’t seal is part of sealing.

Answer 3. Because the similar problem’s role is not skill improvement but confirming the cheat sheet works. The sealing drill’s deliverable is "the cheat sheet’s reinforced one line," and the similar problem is the test bench verifying that the line operates in order in front of an actual problem. That’s why you pick a very easy problem and cap it at 15 minutes — pick a hard one and start learning something new, and verification degrades into study, collapsing the 30-minute cap.

Answer 4. Because searching right after the competition starts ("where was that script") is both a time loss and a signal of anxiety. The very act of searching creates the feeling "I’m underprepared" and rushes judgment. A self-sufficient pack means every need after the start resolves inside one folder, and just knowing that lowers the day’s heart rate. Calm is not a personality trait but a function of your materials.

Completion Criteria Checklist

[ ] I selected competition #11’s unsolved problems by the criteria and completed block A debriefing
[ ] Seal/defer decisions were recorded per item, and deferred items carry avoidance rules
[ ] I wrote one competition #11 Write-up and updated the cumulative counter
[ ] I assigned priorities on the final repeated-miss list (frequency 2+)
[ ] I completed 30-minute sealing drills and sealing records for top items (cap of 2 per day observed)
[ ] Cheat sheets and library were updated to reinforced versions
[ ] I completed the battle pack’s five folders and held the team final inspection meeting

6. Common Pitfalls & Fixes

Wall 1. Re-reading keeps surfacing things I want to learn

Symptom: the "study later" memos in the debrief notes keep catching your eye.

Cause: anxiety disguised as a love of learning — the moment 2-1’s warning becomes real.

Fix: move the memos to the "post-qualifier" folder and visually close it. And verify with arithmetic — spend 3 hours on that item now and four sealing drills disappear. Four verified accuracies versus one unverified piece of knowledge: the side that earns points in the qualifier is the former.

Wall 2. My repeated-miss list has over 10 items

Symptom: the re-read makes you look full of holes.

Cause: either you relaxed the criteria and mixed in frequency-1 items, or the twelve cycles’ debriefs were genuinely shallow.

Fix: first, boldly delete everything below frequency 2 — the list’s value lies in its shortness. If it’s still long, seal only the top 4 this time and handle the rest entirely with avoidance rules. It doesn’t have to be perfect — the holes of a team that played twelve competitions can’t all be filled in two days, and accepting that is the closing criterion.

Wall 3. My 30-minute seals keep running past an hour

Symptom: the similar problem doesn’t solve as easily as expected and you keep gripping it.

Cause: the problem choice was too hard, or that item is a learning target, not a sealing target.

Fix: when 30 minutes rings, stop immediately and reclassify the item as "deferred (learning target)." And re-pick the similar problem as the easiest of the same type — the easier the verification problem, the better. Right now we are not measuring skill; we are inspecting a cheat sheet.

Wall 4. A teammate skips the final inspection meeting

Symptom: everyone’s busy and wants to settle for document sharing.

Cause: the meeting’s value is invisible — but as 3-5 said, a document without verbal confirmation doesn’t work on the day.

Fix: fix it at 30 minutes and send the agenda in advance. If even that fails, compress just item 2 (strategy read-aloud) to 10 minutes and gather briefly in a voice channel. A short meeting beats a perfect one, and no meeting is far worse than a short one.

Wall 5. Everything’s organized and now I’m anxious with nothing to do

Symptom: pack complete, sealing done — and your hands itch.

Cause: unfamiliarity with the prepared state. The illusion that only filling is training.

Fix: that anxiety is itself the final training task before the qualifier — the practice of adding nothing more. Return to Step 300’s condition plan table and execute the D-2 and D-1 clauses (re-run inspections, early bedtime). Executing what you know accurately in peak condition — that is your entire qualifier strategy.

7. Summary

Today’s Concepts

Concept	One-line explanation
Sealing	Not filling holes but plugging leaks — only what seals in 30 minutes
Frequency × recovery cost	The sealing priority’s two axes — most frequent and cheapest to plug first
Avoidance strategy	Explicit handling of unsealed items — one line of "if it appears, hold"
30-minute sealing drill	Cheat-sheet reinforcement 10 + similar-problem verification 15 + sealing record 5
Battle pack	The qualifier-day self-sufficient folder — playbook/cheatsheets/library/checklist/contacts
Closing criterion	Doesn’t have to be perfect — the most frequent leaks first, avoidance rules for the rest

Today’s Tools & Forms

Tool/form	What it does
Final repeated-miss list	Extraction of frequency-2+ failures — the shorter the better
Sealing record one-liner	"What was blocked and which cheat-sheet line blocks it"
Write-up cumulative counter	Progress tracking for Step 303’s eligibility conditions
Battle-pack folder structure	Self-sufficient assets in five folders
Final inspection meeting agenda	Pack share + verbal strategy confirmation + day-of logistics

The Core Instinct

At the end of the twelfth debrief, your skill has not grown larger — instead, it leaks less. Competition-floor points are not skill’s total but skill times execution accuracy, and today you raised that accuracy.

And remember the skill of closing. A person who keeps trying to fill is anxious until the qualifier’s eve; a person who declares "this far" spends the remaining days on sleep. "It doesn’t have to be perfect" is not giving up — it is a strategic closing that twelve cycles of data have licensed.

Once every box is checked, Step 301 is complete. Click the checkbox in the sidebar to save your progress.