The CWAP Engagement Path

Why no flags?

Real assessments don't hand you a flag{} when you win. You decide what 'compromise' means, you gather evidence, and you communicate risk. These machines remove the flag crutch so you practice the parts clients actually pay for: judgement, coverage, and reporting.

1 · Qualify

A 50-question quiz gates the range. You need 70%. It's not busywork — the debrief assumes you know the fundamentals (BOLA/BFLA, JWT, XSS, CSRF, SSRF, SQLi, logic, disclosure, HTTP, process). If you can't pass it, you're not ready to test a live app.

2 · The plan (90 minutes)

Before you touch the target you write a plan. A good plan states:

• Scope & targets — what's in, what's explicitly out.
• Rules of engagement — window, allowed techniques, what you won't do, how you handle data.
• Methodology — recon → surface mapping → auth → authz matrix → input/injection → logic → disclosure.
• Tooling — what you'll use and why.
• Objectives — what 'done' looks like.

No plan, no access — exactly like a real engagement.

3 · Hack (24 hours)

Work the plan. Enumerate the whole surface first, then go class by class. Track every finding with the exact request that proves it. Chain low-severity issues into real impact. Don't rathole — note, move on, circle back.

4 · How to write the report

A report is the deliverable. Structure it:

• Executive summary — risk in plain language for non-technical readers; count criticals/highs.
• Methodology — approach, scope, tooling.
• Findings — one per issue: title, severity (with CVSS-style reasoning), affected endpoint, reproduction steps (exact requests), evidence, impact, and remediation.
• Appendices — raw request/response logs, notes.

Write findings as you go, not at the end. Severity = likelihood × impact, in this app's context (a bank overdraft logic bug ≠ a blog typo).

5 · How to debrief

The debrief is where you turn testing into learning:

• You record the debrief — a ≤10-minute video walking your engagement, submitted on the machine's debrief page. It's your CMWAP deliverable, scored on the five dimensions above.
• Note what you missed and why — a methodology gap, a skipped input, an unverified assumption.
• For a real client debrief: walk the highest-impact findings first, show the reproduction live, agree remediation and a retest date, and keep it collaborative — you're helping them, not scoring points.