Three short checks · YanoSec Academy

Use the owned Desk Lamp mini-board to connect three skills: selecting a task category, naming the method to apply and citing evidence for a conclusion. The three guided items are self-review activities. The single understanding question after them checks a separate short scenario.

A category is the organizer's label, a method is the operation you use and evidence is the specific line, value or header supporting your claim. Keep those jobs separate. Finding a useful label does not prove a result, and a result without a citation is difficult for another reader to assess.

Before you begin

Recommended first: Where practice is allowed, How to take notes, Logs as evidence, Binary, hex, Base64, and URL encoding, HTTP methods, headers, status codes, cookies, How a YanoSec team sits down for a CTF
Estimated time: 16 min reading, 20 min activity. Setup and optional practice may take longer.
Where you work: Use the original fictional Desk Lamp board and supplied files in any current desktop or mobile browser. No account, event registration, installation or network request is required. Keep draft notes in your own file.
Without a lab: All board rows, requests, rules and log lines needed for reasoning are printed here. Trace them in notes and compare with the activity rubric; label fictional or predicted evidence accurately. Reading works without JavaScript. Checking needs JavaScript and a secure context; saving also needs usable browser storage.

After this lesson you can:

Match the Base64 card to its category column.
Name the http skill on the saved request and cite the lamp-on log line.
Choose the evidence category for a new sentence about timestamped logs and cited lines.

01Example

Worked sample, separate from the three checks. An encoding note is a representation task. The field sentence later is a log task. Do not copy this sample's category onto the question.

Sample card, not C-2 and not L-6
Task: map 64 65 73 6b
Category on this board: Cryptography
Skill: encodings
Evidence: 64 is d, 65 is e, 73 is s, 6b is k
Limit: the mapping is a prediction from code points, not a tool transcript

02Three checks, one saved question

The packet supplies an encoding note, a saved request and a fictional log. You do not need a platform account, a live target or a running tool. Read each supplied item and write its requested result in notes before using the rubric.

The board's categories are local filing choices. Encoding is grouped under Cryptography despite not being encryption. Recorded-event analysis is grouped with evidence work. Real organizers may choose broader or different labels; the required question gives the two choices it expects you to compare.

On one owned board, name a category, a taught skill, and a cited line, then file a new log sentence by the job it asks for.Model. A teaching model drawn by hand. It shows the idea, not real tool output.

Read the full explanation below.

Playback is optional. Step through at your own pace.

Supplied teaching sample

Worked hex bytes

64byte 0

65byte 1

73byte 2

6bbyte 3

Code-point correspondence

dcode point

ecode point

scode point

kcode point

Worked reading

deskworked result

64 → d64 → d

65 → e65 → e

73 → s73 → s

6b → k6b → k

Match each supplied byte with its letter.

Follow the explanation

Match each supplied byte with its letter.
The letters in byte order spell desk; keep the sample and evidence limit visible.

Read every state and value

1. Match each supplied byte with its letter.

Example: Supplied teaching sample
Visible Item: 64 · 65 · 73 · 6b · 64 → d · 65 → e · 73 → s · 6b → k
Current mappings: 64 → d · 65 → e · 73 → s · 6b → k
Annotations: None

2. The letters in byte order spell desk; keep the sample and evidence limit visible.

Example: Supplied teaching sample
Visible Item: 64 · 65 · 73 · 6b · 64 → d · 65 → e · 73 → s · 6b → k · desk
Current mappings: word
Annotations: Item: desk; Text: Worked sample only: category Cryptography; skill encodings. Not C-2 or L-6.

Classify the task using cited evidence; this worked encoding sample is not the later log question.

03Check 1, category

Read C-2. The ungraded line you write is the category column.

Card C-2
Category column: Cryptography
Transform named on the card: Base64
Note: bGFtcA==
Predicted text: lamp
Prediction source: Python 3 standard library, base64.b64encode of the bytes lamp, during asset packaging.
 This note is not a flag. Do not submit it anywhere.

Download the C-2 encoding note

Read the category column and the transform name.
The note is Base64. The predicted word lamp is a packaging result. Leave it off any public page.
Check: the category word for this item is cryptography.
Stop after recording this activity result.

04Check 2, skill

Read the saved request. Do not send it.

Card W-8
Label: saved request. Do not send it. desk.example is a fictional name in this packet. No lookup.

GET /lamp HTTP/1.1
Host: desk.example
Accept: text/plain
Connection: close

Download the W-8 saved request

Name the method, the path, and the Host header.
The method is GET, the path is /lamp, and the host text is desk.example.
Check: the taught skill for this item is http.
Stop. Do not look up the host.

05Check 3, evidence

The log has three lines and states UTC. Cite the line that records the lamp turning on.

Card L-6
Label: original fictional log. Not a copy of a server.
The card states that these stamps are UTC. The date is 2026-10-12. The Z is written on each line.

L1 2026-10-12T18:00:01Z lamp off
L2 2026-10-12T18:04:10Z switch found
L3 2026-10-12T18:04:40Z lamp on

Download the L-6 log

Desk Lamp mini-board
Label: original fictional packet. No live host, no flag, and no scoreboard submission.
Printed window: 2026-10-12 18:00-21:00 UTC.
Sharing: keep method notes in your own file. Do not post a solution. Do not send a message from this page.

ID   Category               Value  State  Task
F-3  Files                  50     open   Read the local note. First line: the spare lamp is on shelf 2.
W-8  Web                    50     open   Read the saved request in this file. Do not send it.
C-2  Cryptography           100    open   The note in this file is Base64.
L-6  Forensics              100    open   Cite one line from the log in this file.
R-4  Reverse Engineering    200    later  Follow a compare and a jump in assembly. Not required for First CTF.
P-9  Binary exploitation    300    later  A write goes past the end of a buffer. Not required for First CTF.

Saved request for W-8
GET /lamp HTTP/1.1
Host: desk.example
Accept: text/plain
Connection: close

Encoding note for C-2
Transform: Base64
Note: bGFtcA==
Predicted text: lamp
Prediction source: Python 3 standard library during asset packaging.

Log for L-6
The card states that these stamps are UTC.
L1 2026-10-12T18:00:01Z lamp off
L2 2026-10-12T18:04:10Z switch found
L3 2026-10-12T18:04:40Z lamp on

Rules
Use only this file and the lesson cards. A Host header is text. The scoreboard is out of scope.

Download the mini-board as text

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Desk Lamp mini-board</title>
</head>
<body>
<h1>Desk Lamp mini-board</h1>
<p>Original fictional packet. No live host, no flag, and no scoreboard submission.</p>
<p>Printed window: 2026-10-12 18:00-21:00 UTC. Keep method notes in your own file. Do not post a solution. Do not send a message from this page.</p>
<table>
<thead>
<tr><th>ID</th><th>Category</th><th>Value</th><th>State</th><th>Task</th></tr>
</thead>
<tbody>
<tr><td>F-3</td><td>Files</td><td>50</td><td>open</td><td>Read the local note. First line: the spare lamp is on shelf 2.</td></tr>
<tr><td>W-8</td><td>Web</td><td>50</td><td>open</td><td>Read the saved request in this file. Do not send it.</td></tr>
<tr><td>C-2</td><td>Cryptography</td><td>100</td><td>open</td><td>The note in this file is Base64.</td></tr>
<tr><td>L-6</td><td>Forensics</td><td>100</td><td>open</td><td>Cite one line from the log in this file.</td></tr>
<tr><td>R-4</td><td>Reverse Engineering</td><td>200</td><td>later</td><td>Follow a compare and a jump in assembly. Not required for First CTF.</td></tr>
<tr><td>P-9</td><td>Binary exploitation</td><td>300</td><td>later</td><td>A write goes past the end of a buffer. Not required for First CTF.</td></tr>
</tbody>
</table>
<h2>Saved request for W-8</h2>
<pre>GET /lamp HTTP/1.1
Host: desk.example
Accept: text/plain
Connection: close</pre>
<h2>Encoding note for C-2</h2>
<p>Transform: Base64. Note: bGFtcA==. Predicted text: lamp. Prediction source: Python 3 standard library during asset packaging. </p>
<h2>Log for L-6</h2>
<p>The card states that these stamps are UTC.</p>
<pre>L1 2026-10-12T18:00:01Z lamp off
L2 2026-10-12T18:04:10Z switch found
L3 2026-10-12T18:04:40Z lamp on</pre>
<p>Use only this file and the lesson cards. A Host header is text. The scoreboard is out of scope.</p>
</body>
</html>

Download the mini-board as HTML

Confirm the three lines share 2026-10-12 and the card's UTC statement.
L2 at 18:04:10Z says the switch was found. L3 at 18:04:40Z says the lamp is on.
Check: cite L3.
Stop. Do not treat the lines as a capture from a real lamp.

06Stage note

Allow about twenty minutes for the final self-review note. Choose a ready card, identify a later skill, state your method, cite evidence, describe a limit and record the sharing rule. Another learner should be able to follow the reasoning without receiving an outside event's answer.

First CTF can be completed using these supplied materials. External events are optional; Testing, Reversing and Pwn are not entry requirements. Browser completion records understanding checks here, rather than proving an event solve or a practical tool run.

Stage note for three-short-checks
Self-review activity.
Write six lines in your own file. Do not post them. Do not send them.

1. Ready card id. One of F-3, W-8, C-2, L-6.
2. A later card that can wait. R-4 or P-9, plus the skill name assembly or memory.
3. Method: what you would read first on the ready card.
4. Evidence: the line, header, or note you would cite.
5. Limit: one thing that citation does not prove.
6. Sharing: the note stays in your file.

Download the stage-note rubric

Writeup
Title:
Card id:
Task in one sentence:
What you tried:
Evidence you can point to:
Limit, what this does not prove:
Sharing: private file, unless a written release is actually in the packet.
Flag: leave blank. This course does not collect one.

Download the writeup template

Pick a ready id: F-3, W-8, C-2, or L-6. Name R-4 or P-9 as a card that can wait.
Write the method, the evidence you would cite, and one limit.
Write the sharing line: the note stays in your file.
Stop. The note does not ask for the required question's word.

07Optional challenge

Self-review the three check lines. Confirm item 1 names the encoding category, item 2 names http, and item 3 cites L3. Fix a swapped line in your own file. About ten minutes. Do not post the review.

08Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

Encoding card A: independent declared representationOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

Task A9: decode a standard Base64 note using the declared public representation.
This board groups representation transforms under Cryptography; memory-write tasks under Binary exploitation; saved-request reading under Web; event reconstruction under Forensics.
No decoded text or flag is needed for this task classification.

Request card B: separate saved text, unsentOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

GET /garden HTTP/1.1
Host: paper.example
Accept: text/plain
The host is fictional text to read; do not resolve it or send a request.

Log card C: independent fictional same-clock UTC lines, shuffledOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

C7 2026-10-23T20:02:10Z hatch closed
C5 2026-10-23T20:01:40Z hatch opened
C9 2026-10-23T20:02:30Z latch checked
C6 2026-10-23T20:02:00Z hatch inspected
All lines are from the same stated UTC clock on the same date. Cite the event requested, not the visually first row.

09Explain the evidence and its limit

Optional self-check: write a six-line stage note with ready task, deferred skill, method, evidence citation, limit and sharing rule.

Review it: keep encoding classification, HTTP fields and log chronology distinct; cite each supplied artifact; do not add an outside flag, network request or unauthenticated origin claim.

10Common mistakes

If the required question receives the encoding card's category, item 1 was copied onto a log sentence. The log sentence asks you to reconstruct events and cite lines.

If L2 is cited for the lamp turning on, the earlier switch line was read as the later event. L3 is 18:04:40Z.

If the stage note is posted or sent, the sharing line was skipped. This page has no send action.

Check 1
Use Encoding card A. Which category fits the declared operation on this board?
- Web
- Forensics
- Cryptography
- Binary exploitation
Check 2
Use independent Request card B. What is the request path? Enter only the path with its leading slash and exact lowercase spelling.
Format: A full path that starts with /. A trailing slash is ignored except for / itself. Capital and lowercase letters must match.
Check 3
Use independent Log card C. Which line records the hatch closing after inspection but before the latch check? Enter its line id exactly.
Format: Match the text, including capital and lowercase letters. Spaces at the ends do not matter.
Check 4 (optional)
Optional: which stage note accurately combines these independent cards?
- A classifies a representation task; B supports one request-path reading; C supports a same-clock event order. No network action or author identity is established.
- Readable fields prove who produced every artifact.
- All three cards prove a live tool run and a real event solve.
- The Host header authorizes testing the host and scoreboard.

0 of 3 required checks answered.

Practice

References

CTFd: Challenge categories
The page describes categories the authors see in their events and in most CTFs. Cryptography examples there are ciphertexts and algorithms. Base64 is not one of those examples. Exploitation examples there are memory flaws that reach a shell.
CyLab Security Academy
Describes self-paced practice, events and broad skill domains. Individual challenge launches and account access are separate from this reading activity.
CTFd: What are flags
A flag is the proof that a participant completed a challenge, and the platform checks a submission against stored flags. This course's checker is a separate box.