Exploit and Patch

The attack: Exploit

An exploit takes advantage of a software vulnerability, that is a bug in the code of a server, an application or a device, to make it do what it should not: read confidential data, run commands, skip a check. Known vulnerabilities have a public identifier (CVE) and almost always a fix; the real danger is systems left without updates for months, and flaws nobody knows about yet (zero-days).

The defence: Patch

Patches are the updates that fix software vulnerabilities. Managing them well means knowing which systems you have (inventory), knowing the flaws that affect them, prioritising the ones actually being exploited and installing fixes quickly, testing them first where needed. Many famous attacks used flaws that had been fixed months earlier.

What stops what

• Patch against Exploit: half damage. Updating the software closes exactly the flaw the exploit relies on.
• Exploit against Training: double damage. The exploit hits a service without anyone having to click anything: people’s attention does not stop it.
• Exploit against MFA: double damage. The exploit never goes through the login, it skips authentication entirely: the second factor never comes into play.
• Phishing against Patch: double damage. There is no software bug to fix: the weak point is the trust of whoever reads the message.
• Brute force against Patch: double damage. It exploits no flaw, it uses the login feature as it is: no update makes a weak password strong.

In every other match-up damage is normal.

Combos with Exploit

• Kill chain (Scanning → Exploit or Brute force, +2 damage): first you find out what is exposed, then you attack the weak spot you found.
• Escalation (Exploit → Malware, +2 damage): an exploited flaw opens the way to installing malware.
• Diversion (DDoS → Exploit, +2 damage): while defenders are busy with the DDoS, an exploit slips through unnoticed.

Exploit attack cards (15)

Known exploit

#004 · Attack · Exploit · ◆2 · power 3 · Common · Arena 1 (Laboratory)

Abuses a public vulnerability (CVE) on unpatched systems.

Fuzzing

#017 · Attack · Exploit · ◆1 · power 2 · Common · Arena 1 (Laboratory)

Throw weird input at a program until something breaks. Cheap and fast.

Remote code execution

#005 · Attack · Exploit · ◆4 · power 6 · Rare · Arena 2 (Corporate network)

RCE: running your own code on someone else’s server.

Cross-site scripting

#027 · Attack · Exploit · ◆1 · power 1 · Common · Arena 2 (Corporate network)

Enemy defenses are exposed (+1 damage) for 1 turn.

SQL injection

#028 · Attack · Exploit · ◆2 · power 3 · Common · Arena 2 (Corporate network)

Also deals 1 direct damage to the core.

Misconfiguration exploit

#096 · Attack · Exploit · ◆2 · power 3 · Common · Arena 2 (Corporate network)

Abuses a configuration mistake rather than a code bug: an open port, overly broad permissions, a default password. The strongest enemy defense loses 1 toughness.

Hypervisor escape

#182 · Attack · Exploit · ◆4 · power 6 · Rare · Arena 3 (Data center)

From a virtual machine you reach the system that hosts it, breaking the isolation between customers. Prevented by patching the hypervisor and keeping critical workloads apart. The strongest enemy defense loses 1 toughness.

Container escape

#201 · Attack · Exploit · ◆5 · power 6 · Epic · Arena 5 (Cloud)

From the container to the host that runs it: the isolation breaks. Prevented with minimal images, a non-root user and seccomp profiles. 2 damage to every enemy defense.

Privilege escalation

#029 · Attack · Exploit · ◆6 · power 8 · Epic · Arena 7 (Cyber range)

The opponent has 1 less bandwidth for 1 turn.

Zero-click

#101 · Attack · Exploit · ◆6 · power 10 · Legendary · Arena 7 (Cyber range)

Compromises a device without the victim touching anything, not even a link. Ignores countermeasures, destroys an enemy terrain (the most expensive), and the strongest enemy defense loses 2 toughness.

Session hijacking

#215 · Attack · Exploit · ◆4 · power 6 · Rare · Arena 7 (Cyber range)

The already-authenticated cookie is stolen and you walk in without going through MFA. Limited by binding the session to the device. Ignores countermeasures.

Zero-day

#006 · Attack · Exploit · ◆6 · power 9 · Legendary · Arena 8 (Zero-day)

A flaw nobody knows about yet: there is no patch. Ignores countermeasures.

APT

#023 · Attack · Exploit · ◆5 · power 5 · Epic · Arena 8 (Zero-day)

Advanced Persistent Threat: a group that stays in the network for months. For 2 turns the opponent has 1 less bandwidth.

Supply chain attack

#030 · Attack · Exploit · ◆8 · power 12 · Legendary · Arena 8 (Zero-day)

Ignores countermeasures and deals 2 damage to every defense.

Prompt injection

#222 · Attack · Exploit · ◆2 · power 2 · Common · Arena 8 (Zero-day)

Instructions hidden in a text that an AI assistant carries out as if they came from its owner. Limited by separating instructions from data and restricting permissions. The opponent discards 1 random card.

Patch defence cards (6)

Patch Tuesday

#045 · Defense · Patch · ◆2 · toughness 4 · Common · Arena 1 (Laboratory)

Regular security updates: they close known holes.

Automatic updates

#058 · Defense · Patch · ◆1 · toughness 2 · Common · Arena 1 (Laboratory)

Regenerate: +1 toughness at turn start.

Vulnerability management

#046 · Defense · Patch · ◆4 · toughness 7 · Rare · Arena 3 (Data center)

Inventory, scans and priorities: you know what to update first.

Patching center

#104 · Defense · Patch · ◆3 · toughness 5 · Rare · Arena 3 (Data center)

A team that tests and rolls out updates on every system, leaving none behind. Repairs allies: +1 toughness to your other defenses at turn start.

Redundant RAID

#179 · Defense · Patch · ◆2 · toughness 3 · Common · Arena 3 (Data center)

Data is written across several disks: if one breaks, the others keep the service up. Repairs allies: +1 toughness to your other defenses at turn start.

Sovereign data vault

#112 · Defense · Patch · ◆7 · toughness 10 · Legendary · Arena 8 (Zero-day)

Data in a vault under your own control and jurisdiction: “data sovereignty”. Heals the core: +2 integrity at turn start. Armor: −1 to every hit taken. Regenerate: +1 toughness at turn start.

Related guides

• SQL injection explained: what it is and how to prevent it

The other card groups

• Phishing and Training
• Malware and EDR
• Brute force and MFA
• Scanning and IDS
• DDoS and Firewall
• Support cards
• Terrains
• Traps
• Spells

All cards and the type chart