Attack Defense Observations

On Creating Our Own Platforms

• Participants should not receive the traffic until some number of rules are met.
• Only traffic from the attacker’s end should be given.
• The round changes need to be better tracked (on the platform side, announce with little notification boxes)
• Functionality checks should be done on submission of a patch rather than constantly being done. 

On Playing A/D

• https://github.com/lunixbochs/revsync
• Convert network pcap to exploit script
• Patching binaries is difficult to do manually with binary ninja due to lack of space. Need to prepare something as a generic patching solution
• Generate fake data when attacking with our real exploits as chaff
• Collection of libc versions and environments to test heap vulnerabilities
• Generalised filtering strategies/patcher
• File integrity management
• Backup strategies (should backup more than just files)

CPAD Platform

• Tables are setup with a power strip and an unmanaged switch per team.
• Pwnables are run in a nsjail.