In the CTF's implementation, the 2nd piece of the password would only be checked if the first one was correct. You could figure out how many different requests

In the CTF's implementation, the 2nd piece of the password would only be checked if the first one was correct. You could figure out how many different requests were made by correlating TCP sequence numbers. If only 1 request was made, the first piece was incorrect. If 2 requests were made, the 1st piece was correct, but not the second, etc... The attack was akin to a timing attack (but definitely not a timing attack).