Category ID Category Name Card ID Value Description
LOC Location Spoofing LOC2 2 Lucas can trigger a Mass Crowd Crush because he deployed a spoofed Hacker Tracker alert directing 20,000 people to a single, small workshop room that cannot physically support the load.
LOC Location Spoofing LOC3 3 Sarah can cause a Venue-Wide Network Blackout because she used a spoofed Official LVCC Admin Wi-Fi portal to trick the NOC volunteers into entering their backbone credentials on her rogue server.
LOC Location Spoofing LOC4 4 Marcus can provoke a Fire Marshal Shutdown because he placed spoofed Emergency Exit signs that redirect attendees into a dead-end storage closet to test their situational awareness.
LOC Location Spoofing LOC5 5 Elena can disrupt the Official CTF Finals because she spoofed the internal BBB scoring server IP address, causing the teams to send their exploit traffic to her private sniffer instead of the competition engine.
LOC Location Spoofing LOC6 6 David can cause a Financial Audit Failure because he used a spoofed QR code on the Cash-at-the-Door signage that directs attendees to a fake payment processor, stealing the conference's registration revenue.
LOC Location Spoofing LOC7 7 Chloe can provoke a Law Enforcement Intervention because she spoofed the location of a Dark Web Meetup on the official digital maps, leading attendees into a restricted LVCC utility zone monitored by federal sensors.
LOC Location Spoofing LOC8 8 Kevin can trigger a Medical Emergency Delay because he spoofed the First Aid Station location on the venue's interactive kiosks, directing injured attendees to a remote loading dock instead of the medical suite.
LOC Location Spoofing LOC9 9 Sofia can cause a Speaker Safety Breach because she spoofed the Green Room location on the internal staff Slack, directing high-profile government keynotes into an unvetted public hallway.
LOC Location Spoofing LOCX 10 James can provoke a Federal FCC Raid because he spoofed the GPS coordinates of the Aerospace Village’s Live Satellite Link, causing the tracking antennas to point toward a sensitive nearby military frequency.
LOC Location Spoofing LOCJ J Aisha can cause a Registration Gridlock because she spoofed the Badge Activation URL on the electronic badges' screens, leading thousands of people to a dead link that prevents them from entering the hall.
LOC Location Spoofing LOCQ Q Robert can trigger a Venue Evacuation because he spoofed a Hazardous Material Leak alert via the building’s Bluetooth beacon system, mimicking a legitimate LVCC safety broadcast.
LOC Location Spoofing LOCK K Maya can disrupt the Official Merchandise Flow because she spoofed the Merch Line Start location using floor decals, creating a massive human bottleneck that obstructs the West Hall’s main fire exit.
LOC Location Spoofing LOCA A Thomas can provoke a Total Venue Blacklist because he spoofed the hotel’s Digital Concierge resource to collect the room numbers and PII of the international venue managers, leading to a major privacy litigation.
OBS Obstruction OBS2 2 Lucas can trigger a Fire Marshal Shutdown because he used a Goon pretext to physically obstruct the West Hall's primary fire-curtain deployment path with a large, unsanctioned Art-Car installation.
OBS Obstruction OBS3 3 Sarah can cause a Venue-Wide Network Collapse because she used a signal jammer to obstruct the official BBB CTF wireless frequencies, forcing organizers to halt the competition to investigate a suspected federal communication breach.
OBS Obstruction OBS4 4 Marcus can provoke a Mass Stampede Incident because he used Artificial Urgency to obstruct the main staircase with a fake Security Lockdown sign, funneling 10,000 attendees into a dangerously narrow service corridor.
OBS Obstruction OBS5 5 Elena can disrupt the Aerospace Village Live Demo because she used a GPS-spoofing device to obstruct the satellite link of a landing-system simulation, potentially causing the FAA to revoke the conference's Experimental Radio permit.
OBS Obstruction OBS6 6 David can cause a Registration Gridlock because he physically obstructed the Cash-at-the-Door QR-scanners with a mystery hardware device, creating a crowd-crush scenario that forced LVCC security to stop all entry.
OBS Obstruction OBS7 7 Chloe can trigger a Medical Emergency Delay because she obstructed the designated EMS Lane in the West Hall parking lot with a Pop-up Party, preventing paramedics from reaching a distressed attendee in the Biohacking Village.
OBS Obstruction OBS8 8 Kevin can provoke a Venue Power Blackout because he obstructed the airflow to the West Hall’s primary electrical transformers with Sound-Dampening foam for a private party, causing a thermal shutdown.
OBS Obstruction OBS9 9 Sofia can cause a Speaker Safety Breach because she used a Staff Only sign to obstruct the legitimate Green Room entrance, redirecting high-profile government speakers into a side room for an unauthorized interview.
OBS Obstruction OBSX 10 James can trigger a Digital Signage Failure because he used a Firmware Update USB stick to obstruct the LVCC’s wayfinding kiosks, leaving 30,000 attendees unable to locate emergency exits or talk rooms.
OBS Obstruction OBSJ J Aisha can provoke a Law Enforcement Raid because she used a Physical Security Audit pretext to obstruct the latch on a restricted LVCC utility door, allowing unvetted non-attendees to enter the building’s secure perimeter.
OBS Obstruction OBSQ Q Robert can cause a Social Engineering Contest Scandal because he used a Bluetooth Spam attack to obstruct the smartphones of the SECTF judges, preventing them from monitoring a live (and potentially dangerous) social engineering call.
OBS Obstruction OBSK K Maya can disrupt the Official Merchandise Flow because she used a Payment Error pretext to obstruct the official mPOS tablets, forcing thousands of attendees into a stagnant, unmanaged queue that blocked the main hall artery.
OBS Obstruction OBSA A Thomas can provoke a Total Venue Blacklist because he used Lock Picking to obstruct the hotel’s master keycard system, preventing hundreds of attendees from accessing their rooms and creating a public safety crisis in the lobby.
MAN Manipulation & Elicitation MAN2 2 Lucas can trigger a Venue-Wide Evacuation because he used Artificial Urgency to convince a group of attendees that there was a gas leak in the West Hall, causing a dangerous crowd crush at the exit doors.
MAN Manipulation & Elicitation MAN3 3 Sarah can cause a Federal Law Enforcement Intervention because she used The Recruiter Ruse to elicit classified aerospace protocols from a government speaker under the guise of a high-level job interview for a defense contractor.
MAN Manipulation & Elicitation MAN4 4 Marcus can provoke a Public Health Shutdown because he used Sympathy Exploitation to bypass Biohacking Village safety barriers, claiming he needed urgent medical data for a sick relative, which led to a hazardous material exposure.
MAN Manipulation & Elicitation MAN5 5 Elena can disrupt the Official CTF Finals because she used Fake Peer Validation to trick a Benevolent Bureau of Birds (BBB) organizer into revealing the competition's internal network topography during a casual bar conversation.
MAN Manipulation & Elicitation MAN6 6 David can cause a Financial Audit Failure because he used The Goon Authority Play to manipulate Cash-at-the-Door volunteers into handing over registration tablets for a mandatory security sync that actually harvested payment data.
MAN Manipulation & Elicitation MAN7 7 Chloe can provoke a Diplomatic Incident because she used Fanboy Flattery to lower the guard of an international dignitary, eliciting sensitive geopolitical war stories that were being recorded for a hostile intelligence entity.
MAN Manipulation & Elicitation MAN8 8 Kevin can trigger a Corporate Lawsuit because he used Arrogance Provocation to trick a vendor’s lead engineer into proving their encryption wasn't weak by revealing proprietary source code details in a public hallway.
MAN Manipulation & Elicitation MAN9 9 Sofia can cause a Venue Safety Breach because she used The Damsel/Distress Gambit to manipulate an LVCC technician into letting her borrow a restricted service elevator, giving her physical access to the building’s HVAC controls.
MAN Manipulation & Elicitation MANX 10 James can provoke a Terror-Protocol Response because he used Social Proof Manipulation to lead a large group into a restricted back-of-house area, making LVCC security believe a coordinated breach of the venue perimeter was occurring.
MAN Manipulation & Elicitation MANJ J Aisha can cause a Speaker Safety Crisis because she used Elicitation during a Wait-Time interview in the Green Room hallway to extract the private hotel room numbers and flight itineraries of high-profile keynotes.
MAN Manipulation & Elicitation MANQ Q Robert can trigger a Registration Gridlock because he used Quid Pro Quo to convince dozens of attendees to boycott the official scanners in exchange for limited edition stickers, causing a massive, unmanageable crowd at the entrance.
MAN Manipulation & Elicitation MANK K Maya can cause a Social Engineering Contest Scandal because she socially engineered the official SECTF judges into granting her points for a real-world attack on the LVCC's internal security staff, violating the conference's No-Target policy.
MAN Manipulation & Elicitation MANA A Thomas can provoke a Total Venue Blacklist because he used Alcohol-Induced Elicitation at an official party to trick the LVCC Venue Manager into revealing the master override codes for the West Hall’s digital signage and lighting.
BAI Baiting BAI2 2 Lucas can trigger a National Security Investigation because he left branded Aerospace Village USB drives near the LVCC South Hall (shared with government contractors) containing a beacon that phones home from restricted networks.
BAI Baiting BAI3 3 Sarah can cause a Venue-Wide Network Collapse because she dropped High-Speed Admin Ethernet adapters in the NOC hallway that, when plugged in by a stressed volunteer, execute a Layer-2 loopback attack.
BAI Baiting BAI4 4 Marcus can provoke an FBI Counter-Terrorism Response because he baited a high-traffic walkway with a realistic-looking SDR Suitcase featuring an exposed countdown timer, designed as a social engineering test that looks like an IED.
BAI Baiting BAI5 5 Elena can disrupt the Official CTF Finals because she left cloned BBB organizer badges in the chill-out lounge that, when scanned by curious players, install a persistent credential-sniffing payload on their mobile devices.
BAI Baiting BAI6 6 David can cause a Mass Medical Emergency because he left Biohacking Kit samples in the village area that encouraged attendees to self-test an unverified chemical compound, leading to a hazardous material (HAZMAT) alert.
BAI Baiting BAI7 7 Chloe can provoke a Law Enforcement Raid because she baited the Vendor Area with QR-coded flyers for a Dark Web Physical Marketplace that actually led users to an active federal sting operation portal.
BAI Baiting BAI8 8 Kevin can trigger a Fire Marshal Shutdown because he baited the West Hall's main power pillars with Free Universal Power Strips that were intentionally wired to cause a localized electrical fire when fully loaded.
BAI Baiting BAI9 9 Sofia can cause a Registration Blackout because she left Pre-Activated cash-at-the-door badges on a table, which were actually hardware-modified to brick the official RFID readers upon first contact.
BAI Baiting BAIX 10 James can provoke a Civil Lawsuit because he left Leaked Vendor Prototype laptops in a hotel lobby, which were rigged to record video and audio of anyone who opened them, violating Nevada's privacy laws.
BAI Baiting BAIJ J Aisha can cause a Diplomatic Incident because she left Translator Pro earbuds in the Speaker Lounge that were actually high-gain microphones designed to record and stream private conversations of international dignitaries.
BAI Baiting BAIQ Q Robert can trigger a Venue Evacuation because he baited the LVCC's HVAC intake with a Mystery Vapor device (labeled as an IoT Scent Project) that triggered the building's automated chemical and smoke sensors.
BAI Baiting BAIK K Maya can compromise Speaker Safety because she left VIP Gift Bags in the Green Room containing Smart Watches that were actually GPS trackers intended to follow high-profile government officials back to their secure locations.
BAI Baiting BAIA A Thomas can cause a Total Venue Blacklist by baiting the LVCC's internal Wayfinding kiosks with Free Firmware Update USB sticks, which permanently disabled the venue's digital signage system.
DIG Digital & Wireless DIG2 2 Lucas can trigger a Network Blackout because he deployed high-powered Wi-Fi deauthentication frames to obstruct the official Hacker Tracker app, causing mass confusion and crowd-flow collapse.
DIG Digital & Wireless DIG3 3 Sarah can cause a Venue-Wide Safety Shutdown because she used a Benevolent Bureau of Birds (BBB) pretext to wirelessly spoof the LVCC West Hall’s IoT fire-suppression sensors during the CTF finals.
DIG Digital & Wireless DIG4 4 Marcus can provoke a Federal Communications Commission (FCC) Raid because he operated an illegal high-gain GPS jammer within the Aerospace Village, obstructing critical aviation signals from the nearby Harry Reid International Airport.
DIG Digital & Wireless DIG5 5 Elena can disrupt the Keynote Livestream because she performed a BGP Hijacking attack on the LVCC's dedicated fiber uplink, redirecting the official global broadcast to a malicious server.
DIG Digital & Wireless DIG6 6 David can cause a Financial Audit Failure because he used a Mobile Point of Sale (mPOS) spoofing attack at the official Merch booth to obstruct legitimate credit card processing for thousands of attendees.
DIG Digital & Wireless DIG7 7 Chloe can trigger a Mass Panic Incident because she pushed a forged Emergency Alert System (EAS) notification to every phone in the West Hall via a rogue 5G small-cell base station.
DIG Digital & Wireless DIG8 8 Kevin can compromise the Speaker Reputation System because he used Deepfake audio injection via the venue’s unencrypted wireless microphone frequencies to disrupt a high-profile government presentation.
DIG Digital & Wireless DIG9 9 Sofia can cause a Registration Gridlock because she launched a massive Layer-2 MAC Flooding attack on the West Hall’s switching infrastructure, obstructing the Cash-at-the-door badge activation system.
DIG Digital & Wireless DIGX 10 James can provoke a Public Health Intervention because he wirelessly intercepted and manipulated telemetry data from insulin pumps and pacemakers within the Biohacking Village Live Lab.
DIG Digital & Wireless DIGJ J Aisha can cause a Security Breach Investigation because she used a HID-over-Bluetooth attack to take remote control of the LVCC’s digital signage, displaying prohibited content that violates the venue's Good Standing contract.
DIG Digital & Wireless DIGQ Q Robert can trigger a Venue Evacuation because he performed a BlueBorne exploit on the building’s automated physical access control system, obstructing the Goons from locking or unlocking critical safety zones.
DIG Digital & Wireless DIGK K Maya can disrupt the Electronic Badge Ecosystem because she deployed a Sub-GHz replay attack that bricked the 2026 electronic badges, obstructing the interactive Quest that 30,000 attendees are participating in.
DIG Digital & Wireless DIGA A Thomas can cause a Legal Cease-and-Desist because he set up a Transparent Proxy on the venue's guest Wi-Fi to capture and leak the private PII of international government speakers attending under diplomatic immunity.
PHY Physical PHY2 2 Lucas can trigger a Fire Marshal Shutdown because he obstructed the massive West Hall emergency egress routes with an unsanctioned pop-up village, creating a localized stampede risk.
PHY Physical PHY3 3 Sarah can cause a Venue-Wide Power Failure because she bypassed physical electrical sub-panels in the West Hall floor boxes to draw unmetered power for a high-wattage badge burning station.
PHY Physical PHY4 4 Marcus can provoke a Law Enforcement Intervention because he smuggled prohibited kinetic impact hardware into the Physical Security Village by exploiting the high-volume baggage drop-off zone.
PHY Physical PHY5 5 Elena can compromise LVCC Infrastructure Control because she used a Goon pretext to enter the West Hall’s restricted mechanical mezzanines, gaining physical access to the building’s HVAC and lighting PLCs.
PHY Physical PHY6 6 David can cause a Mass Evacuation because he left an art installation (a suspicious-looking black box with blinking lights) in the high-traffic tunnel connecting the West Hall to the North Hall.
PHY Physical PHY7 7 Chloe can disrupt the Official CTF Finals because she used a physical shim to enter the Benevolent Bureau of Birds (BBB) restricted server room, intending to hardware hack the competition's scoring engine.
PHY Physical PHY8 8 Kevin can trigger a Medical Emergency Delay because he obstructed the designated Aisle 100 Ambulance Access path with a dense crowd of attendees during a spontaneous swag toss event.
PHY Physical PHY9 9 Sofia can cause a Venue Breach Incident because she used a cloned LVCC Staff Badge to bypass the West Hall’s freight elevator security, allowing unvetted non-attendees into the secure Speaker Ready room.
PHY Physical PHYX 10 James can provoke a Corporate Lawsuit Shut-Down because he physically tampered with a vendor’s prototype hardware on the exhibit floor during closed hours, violating the venue's strict liability insurance.
PHY Physical PHYJ J Aisha can cause a Security Lockdown because she used a lock-picking demonstration as a cover to disable the electromagnetic locks on the West Hall’s exterior loading docks.
PHY Physical PHYQ Q Robert can trigger a Terror-Protocol Response because he deployed a drone inside the West Hall’s 40-foot ceilings, obstructing the venue’s internal security sensors and automated fire-suppression lasers.
PHY Physical PHYK K Maya can compromise Speaker Safety because she used a press pretext to bypass the green-room physical barriers, intending to perform an aggressive social engineering audit on a high-profile government keynote.
PHY Physical PHYA A Thomas can cause a Registration Collapse because he physically obstructed the QR-code scanners at the Cash-at-the-door line, creating a crowd crush scenario that forced the Goons to halt entry for two hours.
COR Corncuopia COR2 2 Lucas can trigger a National Security Investigation because he left branded Aerospace Village USB drives near the LVCC South Hall (shared with government contractors) containing a beacon that phones home from restricted networks.
COR Corncuopia COR3 3 Sarah can cause a Venue-Wide Network Collapse because she dropped High-Speed Admin Ethernet adapters in the NOC hallway that, when plugged in by a stressed volunteer, execute a Layer-2 loopback attack.
COR Corncuopia COR4 4 Marcus can provoke an FBI Counter-Terrorism Response because he baited a high-traffic walkway with a realistic-looking SDR Suitcase featuring an exposed countdown timer, designed as a social engineering test that looks like an IED.
COR Corncuopia COR5 5 Elena can disrupt the Official CTF Finals because she left cloned BBB organizer badges in the chill-out lounge that, when scanned by curious players, install a persistent credential-sniffing payload on their mobile devices.
COR Corncuopia COR6 6 David can cause a Mass Medical Emergency because he left Biohacking Kit samples in the village area that encouraged attendees to self-test an unverified chemical compound, leading to a hazardous material (HAZMAT) alert.
COR Corncuopia COR7 7 Chloe can provoke a Law Enforcement Raid because she baited the Vendor Area with QR-coded flyers for a Dark Web Physical Marketplace that actually led users to an active federal sting operation portal.
COR Corncuopia COR8 8 Kevin can trigger a Fire Marshal Shutdown because he baited the West Hall's main power pillars with Free Universal Power Strips that were intentionally wired to cause a localized electrical fire when fully loaded.
COR Corncuopia COR9 9 Sofia can cause a Registration Blackout because she left Pre-Activated cash-at-the-door badges on a table, which were actually hardware-modified to brick the official RFID readers upon first contact.
COR Corncuopia CORX 10 James can provoke a Civil Lawsuit because he left Leaked Vendor Prototype laptops in a hotel lobby, which were rigged to record video and audio of anyone who opened them, violating Nevada's privacy laws.
COR Corncuopia CORJ J Aisha can cause a Diplomatic Incident because she left Translator Pro earbuds in the Speaker Lounge that were actually high-gain microphones designed to record and stream private conversations of international dignitaries.
COR Corncuopia CORQ Q Robert can trigger a Venue Evacuation because he baited the LVCC's HVAC intake with a Mystery Vapor device (labeled as an IoT Scent Project) that triggered the building's automated chemical and smoke sensors.
COR Corncuopia CORK K Maya can compromise Speaker Safety because she left VIP Gift Bags in the Green Room containing Smart Watches that were actually GPS trackers intended to follow high-profile government officials back to their secure locations.
COR Corncuopia CORA A Thomas can cause a Total Venue Blacklist by baiting the LVCC's internal Wayfinding kiosks with Free Firmware Update USB sticks, which permanently disabled the venue's digital signage system.

Provided by Johan Sydseter

OWASP® Dungeons & Daemons

OWASP Dungeons & Daemons is originally created by Johan Sydseter. It is open source and can be downloaded free of charge from the OWASP website. It is is free to use. It is licensed under the Creative Commons Attribution-ShareAlike 4.0 International, so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one. OWASP does not endorse or recommend commercial products or services. OWASP Dungeons & Daemons is licensed under the Creative Commons Attribution-ShareAlike 4.0 International license and is © 2024 OWASP Foundation.