Module S04 — CTF Harness Engineering

CTF Harness Engineering

Speed, domain routing, and benchmark-validated performance.

minutes

artifacts

sub-sections

A harness that solves CTF challenges at competition speed by routing each challenge to the right specialized agent, removing approval gates where it is safe to do so, and automating the flag-extraction-to-submission pipeline. The CTF optimization target inverts several constraints from S02 and S03 — the engineering discipline is knowing which inversions are safe and which are catastrophic.

Key Claims

Load-Bearing Claims

A CTF is not a smaller pentest. It optimizes for speed to flag, not coverage. The harness that takes 40 minutes on a challenge a human solves in 10 is not competitive.

A single undifferentiated harness fails across all six domains for three compounding reasons: context pollution, reasoning drift, and token waste. The cure is the meta-agent-plus-specialists pattern.

HITL removal is safe when target is owned, isolated, and worst-case-bounded. The credential-reuse gate stays even when every other gate is removed — it is the one unbounded-risk action in a CTF context.

Flag detection is middleware on every tool output, not a step the agent remembers to call. The verifier rejects decoys before submission; the CTFd client rate-limits itself.

After This Module

Map the six CTF domains to their reasoning patterns, tool stacks, and context budgets, and explain why a single undifferentiated harness underperforms.

Design a domain router that uses both text and file-type signals, with a TriageAgent fallback for uncertain cases.

Specify the per-domain tool stacks and the lazy-loading pattern that keeps each specialist's manifest narrow.

Apply the three-criterion test for safe HITL removal in CTF contexts, and identify the credential-reuse gate as the one that always stays.

Implement parallel solve attempts (intra- and inter-challenge) with isolated sessions and no shared memory.

Build a flag extractor (regex middleware), a verifier that drops decoys, and a rate-limited CTFd submission client.

Artifacts

Teaching Document

~3,500 words; 3 sub-sections — domain architecture (six domains + router), speed/parallelism/HITL tradeoffs, flag extraction/submission/scoring

READ

Diagrams

5 diagrams — domain router (n8n), per-domain tool stacks, HITL vs autonomous speed comparison, flag extraction pipeline, parallel solve architecture

READ

Slide Deck

reveal.js slide deck, dark theme, design-system teal

READ

Teaching Script

Verbatim teaching transcript, [SLIDE N] cues

READ

Flashcards

Anki flashcards (TSV)

TEST

Exam

Exam bank, Bloom-distributed

TEST

Lab Spec

3 labs — domain router tested on 5 fixtures across 3 domains, HITL-vs-no-HITL timing with three-criterion safety decision, flag extractor + CTFd submission client end-to-end

Module Web Page

Single-file HTML hub

HERE