The PurpleDuel cards
In the PurpleDuel card duel two players face each other with decks of 32 to 64 cards: each one protects their own core, which starts at 64 integrity points, and whoever brings the opponent’s core to zero wins. Every card costs bandwidth (◆), the energy of the turn, which grows turn after turn up to 10.
Attacks hit a deployed defence (you can have up to 5) or, if there are none, the core directly; damage beyond the defence’s toughness still carries over to the core. The cards follow real techniques and countermeasures: each attack type has one defence that halves it and two against which it deals double damage, so the game rewards picking the right protection for the right threat. The catalogue has 231 cards.
What stops what
The type chart is the heart of the game: each defence halves the damage of a single attack type, and each attack deals double damage against the two defences that would not stop it in real life. Against all the others damage is normal.
| Attack | Countered by (½) | Double damage against (×2) |
|---|---|---|
| Phishing | Training | Firewall, Patch |
| Exploit | Patch | Training, MFA |
| Malware | EDR | Training, Firewall |
| Brute force | MFA | IDS, Patch |
| Scanning | IDS | MFA, EDR |
| DDoS | Firewall | EDR, IDS |
The cards, group by group
Each page explains the security concept behind a kind of card and lists all of them, with cost, rarity and arena:
- Phishing and Training
17 cards
- Exploit and Patch
21 cards
- Malware and EDR
25 cards
- Brute force and MFA
19 cards
- Scanning and IDS
18 cards
- DDoS and Firewall
19 cards
- Support cards
61 cards
- Terrains
20 cards
- Traps
17 cards
- Spells
14 cards
Combos
A combo triggers when, in the same turn, an attack completes a sequence that really exists in real attacks (the so-called kill chain): the card that completes it deals extra damage.
- Kill chain (Scanning → Exploit or Brute force, +2 damage): first you find out what is exposed, then you attack the weak spot you found.
- Delivery (Phishing → Malware, +2 damage): the bait message carries the malware inside, as in most real infections.
- Credential theft (Phishing → Brute force, +2 damage): passwords obtained through phishing make login attempts far more effective.
- Storm (DDoS → DDoS, +2 damage): waves of traffic one after another add up their effects.
- Reconnaissance (Scanning → Phishing, +2 damage): knowing who works where and with which systems makes phishing believable.
- Escalation (Exploit → Malware, +2 damage): an exploited flaw opens the way to installing malware.
- Diversion (DDoS → Exploit, +2 damage): while defenders are busy with the DDoS, an exploit slips through unnoticed.
- Persistence (Malware → Malware, +1 damage): malware that is already installed downloads and hides more of it.
Rarity and arenas
Every card has a rarity (common, rare, epic or legendary): rarer cards have higher numbers and go into a deck in fewer copies. Cards are found by climbing arenas with the trophies won in challenges; there are 8 arenas, each with its own theme:
- Arena 1 · Laboratory: The testing ground: phishing, scans, antivirus and basic defenses.
- Arena 2 · Corporate network: Offices and servers: targeted attacks, credentials, firewalls and first traps.
- Arena 3 · Data center: Backups, failover and redundancy: the heart of the infrastructure.
- Arena 4 · SOC: The operations center: logs, alerts, EDR and incident response.
- Arena 5 · Cloud: Cloud services: containers, keys and configurations; scaling, segmenting and trusting no one.
- Arena 6 · Dark web: The black market: botnets, ransomware, attack kits and deception.
- Arena 7 · Cyber range: The range: red team against blue team, identities, industrial networks and crises.
- Arena 8 · Zero-day: End-game cards: unknown vulnerabilities, supply chains, firmware and artificial intelligence.
To learn the technical side there are the simulated labs: All 39 labs