mirror of
https://github.com/cliffe/BreakEscape.git
synced 2026-02-21 19:28:03 +00:00
Complete Mission 3 Stage 0 - Scenario Initialization (4/4 documents, ~2,900 lines)
Stage 0 COMPLETE! All foundation documents created: Document 1: Scenario Initialization (820 lines) ✅ - Mission overview (tier, playtime, ENTROPY cell, SecGen scenario) - CyBOK knowledge areas (NSS, SS, ACS, SOC, HF, AB) - 3-act structure with scene preview - Key NPCs (Victoria Sterling, James Park, Cipher, Agent 0x99) - 4 LORE fragments with campaign significance - Victory conditions (100%, 80%, 60%) - Educational objectives - Campaign arc connections (M1-M2-M4-M6-M7-9) - Post-mission debrief script - Critical decisions: RFID (proximity + social eng), scanning (auto + tutorial), double agent (long-term vs immediate), Architect (name only) Document 2: Technical Challenges (812 lines) ✅ Break Escape In-Game: - RFID Cloning (NEW): Proximity (2 GU, 10s), visual feedback, tutorial, alt paths - Lockpicking: 4 locks (cabinet, office, security, safe PIN 2010) - Guard Patrol: 60s loop, LOS detection, timing strategies - Social Engineering: Victoria trust (0-100), James intel, guard cover stories - Multi-Encoding: ROT13, Hex, Base64, double-encoded (ROT13+Base64) VM/SecGen Challenges: - Network Scanning: nmap, flag{network_scan_complete} - Banner Grabbing: netcat FTP, flag{ftp_intel_gathered}, GHOST codename - HTTP Analysis: Base64 HTML, flag{pricing_intel_decoded} - distcc Exploit: CVE-2004-2687, flag{distcc_legacy_compromised}, M2 connection! Integration: 9 challenges (5 in-game, 4 VM), difficulty scaling, educational rubric Document 3: Narrative Themes (600+ lines) ✅ Theme: Corporate Espionage / Intelligence Gathering Setting: WhiteHat Security Services (Zero Day front company) - Daytime: Professional corporate facade - Nighttime: Espionage thriller tension - Contrast: Same location, two faces NPCs Detailed: - Victoria Sterling: Free-market ideologue, true believer, double agent candidate - James Park: Innocent employee, moral complexity, protection choice - "Cipher": Cell leader (referenced), future villain setup - Agent 0x99: Handler, tutorials, debrief narrator Tone: Espionage thriller (Michael Clayton, Tinker Tailor Soldier Spy) Stakes: Personal (James), Organizational (SAFETYNET vs Zero Day), Societal (exploit marketplace) Central Conflict: Player vs Victoria ideology, vs Zero Day operations, vs Architect (background) Document 4: Hybrid Architecture Plan (700+ lines) ✅ VM Component (SecGen "Information Gathering: Scanning"): - Validates network reconnaissance (nmap, netcat, distcc) - 4 flags represent ENTROPY intercepts - Stable (pre-built, unchanged for assessment consistency) ERB Component (Narrative Content): - Encoded messages (ROT13, Hex, Base64, double-encoded) - LORE fragments (client list, exploit catalog, Architect directives) - NPC dialogues (Ink scripts) - Environmental storytelling Dead Drop Integration: - VM flag → submit at drop-site terminal → unlock in-game resource - flag{network_scan_complete} → workstation access - flag{ftp_intel_gathered} → client codename list - flag{pricing_intel_decoded} → pricing spreadsheet, LORE 2 access - flag{distcc_legacy_compromised} → M2 connection reveal, Agent 0x99 "aha moment" Correlation Matrix: - FTP banner (VM) "GHOST" ↔ Hex client list "Ransomware Inc" ↔ distcc log "ProFTPD sale" - ROT13 whiteboard "THE ARCHITECT" ↔ Double-encoded USB "Architect directives" - Base64 email "$12,500 ProFTPD" ↔ distcc log "ProFTPD sale $12,500" (exact match!) Educational Integration: - Agent 0x99 tutorials (RFID, nmap, netcat, encoding) - Drop-site terminal annotations (port explanations) - CyberChef workstation hints (after failed attempts) Key Mission Features: 🆕 RFID Keycard Cloning (2 GU proximity, 10s clone, progress bar, tutorial) 🎯 M2 Revelation (ProFTPD sold to Ghost for $12,500, hospital ransomware connection) 🎯 Architect Introduction (First direct communication, Q4 priorities, cell coordination) ⚖️ Moral Choices (Victoria: arrest vs double agent | James: protect vs ignore) 📚 Educational (NSS: nmap/netcat, SS: distcc CVE, ACS: multi-encoding, SOC: correlation) Victory Conditions: - 100%: All 4 VM flags + 4 encoded messages + 3 LORE + choices + stealth - 80%: 3 VM flags + 3 messages + 2 LORE + choices - 60%: 2 VM flags + 2 messages + choices Campaign Impact: - Confirms ENTROPY coordination (not independent cells) - Reveals The Architect as real coordinator (not myth) - Proves Zero Day is central exploit supplier - Sets up M4 (Critical Mass SCADA), M6 (Crypto Anarchists), M7-9 (Architect hunt) Stage 0 Status: ✅ COMPLETE (4/4 documents, ~2,900 lines) Next: Stage 1 - Narrative Structure Development (scene-by-scene breakdown)
This commit is contained in:
Claude
@@ -0,0 +1,875 @@
|
||||
# Mission 3: Hybrid Architecture Integration Plan
|
||||
|
||||
**Mission:** Ghost in the Machine
|
||||
**Stage:** 0 - Scenario Initialization
|
||||
**Document:** Hybrid Architecture (VM + ERB) Integration Specification
|
||||
**Date:** 2025-12-24
|
||||
|
||||
---
|
||||
|
||||
## Overview
|
||||
|
||||
Mission 3 uses the **hybrid architecture** approach where VM challenges provide technical skill validation while ERB templates generate rich narrative content. The integration occurs through the **dead drop system**, where VM flags represent intercepted ENTROPY communications that unlock in-game resources.
|
||||
|
||||
---
|
||||
|
||||
## Architecture Components
|
||||
|
||||
### Component 1: VM/SecGen Scenario (Technical Validation)
|
||||
|
||||
**Scenario:** "Information Gathering: Scanning"
|
||||
**Provider:** SecGen
|
||||
**Stability:** Pre-built, unchanged (for assessment consistency)
|
||||
|
||||
**Purpose:**
|
||||
- Validate network reconnaissance skills (nmap, netcat, distcc)
|
||||
- Assess service exploitation competence (CVE-2004-2687)
|
||||
- Provide technical skill benchmarks (CyBOK: NSS, SS)
|
||||
|
||||
**Challenges:**
|
||||
1. Network Port Scanning (nmap)
|
||||
2. Banner Grabbing (netcat FTP service)
|
||||
3. HTTP Service Analysis (Base64 decoding)
|
||||
4. distcc Exploitation (CVE-2004-2687)
|
||||
|
||||
**Flags Generated:**
|
||||
- `flag{network_scan_complete}`
|
||||
- `flag{ftp_intel_gathered}`
|
||||
- `flag{pricing_intel_decoded}`
|
||||
- `flag{distcc_legacy_compromised}`
|
||||
|
||||
---
|
||||
|
||||
### Component 2: ERB Narrative Content (Story & Context)
|
||||
|
||||
**Technology:** Embedded Ruby (ERB) templates in scenario.json.erb
|
||||
**Flexibility:** High (can update narrative without modifying VMs)
|
||||
|
||||
**Purpose:**
|
||||
- Provide narrative context for technical challenges
|
||||
- Create encoded messages (ROT13, Hex, Base64) directly in game world
|
||||
- Generate ENTROPY documents, emails, communications
|
||||
- Enable storytelling without VM dependencies
|
||||
|
||||
**Content Types:**
|
||||
1. **Encoded Messages:**
|
||||
- ROT13 whiteboard message
|
||||
- Hex-encoded client list
|
||||
- Base64 email draft
|
||||
- Double-encoded USB drive (ROT13 + Base64)
|
||||
|
||||
2. **LORE Fragments:**
|
||||
- Zero Day client roster (Hex)
|
||||
- Exploit catalog with pricing (safe)
|
||||
- The Architect's directives (double-encoded)
|
||||
- Victoria's manifesto (whiteboard)
|
||||
|
||||
3. **NPC Dialogues:**
|
||||
- Victoria Sterling conversations (Ink scripts)
|
||||
- James Park interactions (Ink scripts)
|
||||
- Agent 0x99 briefings/debrief (Ink scripts)
|
||||
|
||||
4. **Environmental Storytelling:**
|
||||
- Office documents, sticky notes
|
||||
- Computer files, email drafts
|
||||
- Whiteboards, posters
|
||||
- Physical evidence correlating with VM findings
|
||||
|
||||
---
|
||||
|
||||
### Component 3: Dead Drop System (Integration Layer)
|
||||
|
||||
**Purpose:** Bridge VM challenges and in-game narrative
|
||||
|
||||
**Mechanic:**
|
||||
1. Player completes VM challenge → obtains flag
|
||||
2. Flag represents intercepted ENTROPY communication
|
||||
3. Player submits flag at in-game "drop-site terminal"
|
||||
4. Submission unlocks in-game resources, intel, or access
|
||||
|
||||
**Implementation:**
|
||||
- Drop-site terminal in server room
|
||||
- Ink script handles flag submission
|
||||
- `#complete_task:submit_[flag_name]` triggers objective completion
|
||||
- Unlocks tied to specific flag submissions
|
||||
|
||||
---
|
||||
|
||||
## VM Challenge Integration
|
||||
|
||||
### Challenge 1: Network Port Scanning
|
||||
|
||||
**VM Component:**
|
||||
|
||||
**Objective:** Scan Zero Day's training network to identify open ports and services
|
||||
|
||||
**Tools:** nmap
|
||||
|
||||
**Commands:**
|
||||
```bash
|
||||
nmap 192.168.100.50 # Basic scan
|
||||
nmap -sV 192.168.100.50 # Service version detection
|
||||
nmap -A 192.168.100.50 # Full scan with OS detection
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
```
|
||||
PORT STATE SERVICE VERSION
|
||||
21/tcp open ftp vsftpd 3.0.3
|
||||
22/tcp open ssh OpenSSH 7.4
|
||||
80/tcp open http Apache httpd 2.4.6
|
||||
3632/tcp open distcc distccd v1
|
||||
```
|
||||
|
||||
**Flag:** `flag{network_scan_complete}`
|
||||
|
||||
**Narrative Context (ERB):**
|
||||
|
||||
**What flag represents:**
|
||||
> "You've mapped Zero Day's training network. Their infrastructure is exposed."
|
||||
|
||||
**In-Game Tutorial (Agent 0x99):**
|
||||
> "Access the VM terminal in the server room. Start with nmap to scan the network. Look for open ports and identify services. Those services are ENTROPY communication channels—find them, and you'll intercept their intelligence."
|
||||
|
||||
**Drop-Site Terminal Display (ERB Template):**
|
||||
```erb
|
||||
<%
|
||||
if flag_network_scan_complete_submitted
|
||||
nmap_results = "Network Scan Results:\n"
|
||||
nmap_results += "192.168.100.50 (Zero Day Training Network)\n\n"
|
||||
nmap_results += "PORT SERVICE VERSION\n"
|
||||
nmap_results += "21/tcp FTP vsftpd 3.0.3 (Client comms)\n"
|
||||
nmap_results += "22/tcp SSH OpenSSH 7.4 (Secure access)\n"
|
||||
nmap_results += "80/tcp HTTP Apache 2.4.6 (Web interface)\n"
|
||||
nmap_results += "3632/tcp distcc distccd v1 (Legacy exploit)\n\n"
|
||||
nmap_results += "ANALYSIS: All ports active. Proceed with banner grabbing."
|
||||
end
|
||||
%>
|
||||
```
|
||||
|
||||
**Unlocks:**
|
||||
- Server room workstation access
|
||||
- Educational annotations for nmap output
|
||||
- Next objective: Banner grabbing from identified services
|
||||
|
||||
**Educational Integration:**
|
||||
- Agent 0x99 explains port numbers (21=FTP, 22=SSH, 80=HTTP, 3632=distcc)
|
||||
- Drop-site terminal highlights relevant ports
|
||||
- Context: "These services are dead drops for ENTROPY communications"
|
||||
|
||||
---
|
||||
|
||||
### Challenge 2: Banner Grabbing (FTP Service)
|
||||
|
||||
**VM Component:**
|
||||
|
||||
**Objective:** Connect to FTP service, extract intelligence from banner
|
||||
|
||||
**Tools:** netcat, ftp
|
||||
|
||||
**Commands:**
|
||||
```bash
|
||||
nc 192.168.100.50 21 # Netcat banner grab
|
||||
ftp 192.168.100.50 # FTP client connection
|
||||
```
|
||||
|
||||
**Banner Output:**
|
||||
```
|
||||
220 (vsFTPd 3.0.3)
|
||||
220 Zero Day Syndicate Training Network
|
||||
220 INTEL: Client codename "GHOST" - Last connection 2024-05-15
|
||||
220 flag{ftp_intel_gathered}
|
||||
```
|
||||
|
||||
**Flag:** `flag{ftp_intel_gathered}`
|
||||
|
||||
**Narrative Context (ERB):**
|
||||
|
||||
**What flag represents:**
|
||||
> "You've intercepted FTP communications. Client codename 'GHOST' identified—that's Ransomware Incorporated."
|
||||
|
||||
**In-Game Intelligence Unlock (ERB Template):**
|
||||
```erb
|
||||
<%
|
||||
ghost_intel = {
|
||||
"codename": "GHOST",
|
||||
"organization": "Ransomware Incorporated",
|
||||
"last_connection": "2024-05-15",
|
||||
"notes": "M2 hospital attack operator. Purchased exploits from Zero Day."
|
||||
}
|
||||
|
||||
if flag_ftp_intel_submitted
|
||||
# Unlock client codename document on workstation
|
||||
client_codenames = "ZERO DAY SYNDICATE - CLIENT CODENAMES\n\n"
|
||||
client_codenames += "GHOST: Ransomware Incorporated (Healthcare sector)\n"
|
||||
client_codenames += "VANGUARD: Critical Mass (Infrastructure SCADA)\n"
|
||||
client_codenames += "CASCADE: Social Fabric (Social engineering ops)\n"
|
||||
client_codenames += "\nLast Activity: GHOST - 2024-05-15 (ProFTPD procurement)\n"
|
||||
end
|
||||
%>
|
||||
```
|
||||
|
||||
**Unlocks:**
|
||||
- Client codename list document (correlates with Hex client roster)
|
||||
- M2 connection hint: "GHOST last active during hospital ransomware timeline"
|
||||
- Next objective: HTTP service analysis
|
||||
|
||||
**Correlation Opportunity:**
|
||||
- FTP banner mentions "GHOST"
|
||||
- Hex client list (in-game) shows "Ransomware Incorporated"
|
||||
- Player realizes: "GHOST = Ransomware Inc = Mission 2 hospital attacker!"
|
||||
|
||||
---
|
||||
|
||||
### Challenge 3: HTTP Service Analysis + Base64
|
||||
|
||||
**VM Component:**
|
||||
|
||||
**Objective:** Analyze HTTP service, decode Base64-encoded flag in HTML
|
||||
|
||||
**Tools:** curl, wget, browser, base64
|
||||
|
||||
**Commands:**
|
||||
```bash
|
||||
curl http://192.168.100.50 # Fetch HTML
|
||||
# View source, find comment
|
||||
echo "ZmxhZ3twcmljaW5nX2ludGVsX2RlY29kZWR9" | base64 -d
|
||||
# Output: flag{pricing_intel_decoded}
|
||||
```
|
||||
|
||||
**HTML Output:**
|
||||
```html
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head><title>WhiteHat Security Services</title></head>
|
||||
<body>
|
||||
<h1>Training Network - Authorized Personnel Only</h1>
|
||||
<!-- Pricing Intel (Encoded): ZmxhZ3twcmljaW5nX2ludGVsX2RlY29kZWR9 -->
|
||||
</body>
|
||||
</html>
|
||||
```
|
||||
|
||||
**Flag:** `flag{pricing_intel_decoded}`
|
||||
|
||||
**Narrative Context (ERB):**
|
||||
|
||||
**What flag represents:**
|
||||
> "You've decoded pricing intelligence from HTTP service. Zero Day's exploit pricing model exposed."
|
||||
|
||||
**In-Game Intelligence Unlock (ERB Template):**
|
||||
```erb
|
||||
<%
|
||||
pricing_intel = Base64.strict_encode64("ZERO DAY EXPLOIT PRICING (Q3 2024)\n\nCRITICAL: $35,000\nHIGH: $18,000\nMEDIUM: $7,500\n\nSector Premiums:\nHealthcare: +30%\nEnergy: +40%\nFinance: +50%")
|
||||
|
||||
if flag_pricing_intel_submitted
|
||||
# Unlock pricing spreadsheet on workstation
|
||||
pricing_doc = Base64.strict_decode64(pricing_intel)
|
||||
# Also unlocks LORE Fragment 2 (Exploit Catalog in safe)
|
||||
end
|
||||
%>
|
||||
```
|
||||
|
||||
**Unlocks:**
|
||||
- Pricing spreadsheet document
|
||||
- LORE Fragment 2 accessibility (safe PIN hint: 2010)
|
||||
- Correlation with Victoria's Base64 email (in-game)
|
||||
|
||||
**Educational Integration:**
|
||||
- Reinforces Base64 from M2
|
||||
- Shows Base64 in web services (HTML comments)
|
||||
- Connects to in-game Base64 email from Victoria
|
||||
|
||||
---
|
||||
|
||||
### Challenge 4: distcc Exploitation (CVE-2004-2687)
|
||||
|
||||
**VM Component:**
|
||||
|
||||
**Objective:** Exploit distcc vulnerability, gain shell, find operational logs
|
||||
|
||||
**Vulnerability:** distcc daemon RCE
|
||||
|
||||
**Tools:** Metasploit, manual exploitation
|
||||
|
||||
**Commands:**
|
||||
```bash
|
||||
# Metasploit
|
||||
use exploit/unix/misc/distcc_exec
|
||||
set RHOSTS 192.168.100.50
|
||||
exploit
|
||||
|
||||
# Shell access
|
||||
cd /var/logs/zeroday
|
||||
cat operational_log.txt
|
||||
```
|
||||
|
||||
**Operational Log Content:**
|
||||
```
|
||||
ZERO DAY SYNDICATE - OPERATIONAL LOG
|
||||
OPERATION: ProFTPD Exploit Sale
|
||||
|
||||
Client: Ransomware Incorporated (GHOST)
|
||||
Target: St. Catherine's Hospital
|
||||
Exploit: CVE-2010-4652 (ProFTPD backdoor)
|
||||
Price: $12,500 (Healthcare sector premium)
|
||||
Payment: Confirmed 2024-05-15
|
||||
Status: DELIVERED
|
||||
|
||||
flag{distcc_legacy_compromised}
|
||||
```
|
||||
|
||||
**Flag:** `flag{distcc_legacy_compromised}`
|
||||
|
||||
**Narrative Context (ERB):**
|
||||
|
||||
**What flag represents:**
|
||||
> "You've exploited Zero Day's legacy infrastructure and accessed operational logs. **CRITICAL INTEL:** ProFTPD exploit sold to GHOST for St. Catherine's Hospital attack!"
|
||||
|
||||
**In-Game Intelligence Unlock (ERB Template):**
|
||||
```erb
|
||||
<%
|
||||
m2_connection_intel = {
|
||||
"exploit": "CVE-2010-4652 (ProFTPD backdoor)",
|
||||
"seller": "Zero Day Syndicate",
|
||||
"buyer": "Ransomware Incorporated (GHOST)",
|
||||
"target": "St. Catherine's Regional Medical Center",
|
||||
"price": "$12,500",
|
||||
"date": "2024-05-15",
|
||||
"casualties": "4-6 patient deaths (manual recovery path)"
|
||||
}
|
||||
|
||||
if flag_distcc_submitted
|
||||
# Unlock Agent 0x99 "aha moment" dialogue
|
||||
# Set global variable: m2_connection_revealed = true
|
||||
# Trigger in-game revelation scene
|
||||
end
|
||||
%>
|
||||
```
|
||||
|
||||
**Unlocks:**
|
||||
- **MAJOR REVELATION:** Agent 0x99 contact via phone
|
||||
> "Agent, this is huge. You've found the connection. Zero Day sold the ProFTPD exploit used in Mission 2's hospital ransomware attack. ENTROPY cells are coordinating. This changes everything."
|
||||
|
||||
- M2 connection confirmed (campaign arc progression)
|
||||
- Sets up closing debrief revelation
|
||||
|
||||
**Correlation Opportunity:**
|
||||
- VM operational log shows "ProFTPD CVE-2010-4652"
|
||||
- Player remembers M2: "ProFTPD was the vulnerability Ghost exploited!"
|
||||
- Hex client list (in-game) shows "Ransomware Incorporated"
|
||||
- FTP banner showed "GHOST"
|
||||
- **Player realizes:** "Zero Day supplied the exploit that killed 4-6 patients!"
|
||||
|
||||
---
|
||||
|
||||
## ERB Narrative Content Integration
|
||||
|
||||
### Encoded Message 1: ROT13 Whiteboard
|
||||
|
||||
**Location:** Conference room (daytime accessible)
|
||||
|
||||
**ERB Template:**
|
||||
```erb
|
||||
<%
|
||||
whiteboard_message_plain = "MEET WITH THE ARCHITECT - PRIORITIZE INFRASTRUCTURE EXPLOITS"
|
||||
whiteboard_message_rot13 = whiteboard_message_plain.tr('A-Za-z', 'N-ZA-Mn-za-m')
|
||||
# Output: "ZRRG JVGU GUR NEPUVGRPG - CEVBEVGVMR VASENFGEHPGHER RKCYBVGF"
|
||||
%>
|
||||
|
||||
{
|
||||
"type": "whiteboard",
|
||||
"name": "Strategy Whiteboard",
|
||||
"location": "conference_room",
|
||||
"text": "<%= whiteboard_message_rot13 %>",
|
||||
"observations": "Whiteboard has encrypted message. Use CyberChef to decode ROT13."
|
||||
}
|
||||
```
|
||||
|
||||
**Correlation with VM:**
|
||||
- VM flags teach network reconnaissance
|
||||
- Whiteboard message (ROT13) mentions "THE ARCHITECT"
|
||||
- Player decodes → discovers strategic priorities
|
||||
- Connects to distcc operational log mentioning coordination
|
||||
|
||||
**Educational Value:**
|
||||
- ROT13 classical cipher (easy difficulty)
|
||||
- Pattern recognition (all caps, alphabetic)
|
||||
- CyberChef usage (in-game workstation)
|
||||
|
||||
---
|
||||
|
||||
### Encoded Message 2: Hex Client List
|
||||
|
||||
**Location:** Victoria's computer (executive office)
|
||||
|
||||
**ERB Template:**
|
||||
```erb
|
||||
<%
|
||||
client_list_plain = "ZERO DAY SYNDICATE CLIENT ROSTER\n\nCLIENTS:\nRansomware Incorporated\nCritical Mass\nSocial Fabric\nCrypto Anarchists"
|
||||
|
||||
client_list_hex = client_list_plain.unpack('H*').first
|
||||
# Converts to hexadecimal encoding
|
||||
%>
|
||||
|
||||
{
|
||||
"type": "computer",
|
||||
"name": "Victoria's Workstation",
|
||||
"location": "executive_office",
|
||||
"files": [
|
||||
{
|
||||
"filename": "CLIENT_LIST.txt",
|
||||
"content": "<%= client_list_hex %>",
|
||||
"observations": "File contains hexadecimal-encoded text. Decode to reveal client roster."
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
**Correlation with VM:**
|
||||
- FTP banner mentioned "GHOST" codename
|
||||
- distcc log showed "Ransomware Incorporated"
|
||||
- Hex client list shows ALL Season 1 cells
|
||||
- **Player realizes:** "All ENTROPY cells are Zero Day clients!"
|
||||
|
||||
**Educational Value:**
|
||||
- Hexadecimal encoding
|
||||
- ASCII to hex conversion
|
||||
- Multi-source intelligence correlation
|
||||
|
||||
---
|
||||
|
||||
### Encoded Message 3: Base64 Email
|
||||
|
||||
**Location:** Victoria's email client (computer)
|
||||
|
||||
**ERB Template:**
|
||||
```erb
|
||||
<%
|
||||
victoria_email = "From: Victoria Sterling\nTo: Cipher\nSubject: Q3 Pricing Update\n\nCipher,\n\nQ3 exploit pricing updated:\n\nCRITICAL: $35,000 base\nHIGH: $18,000 base\n\nHealthcare premium: +30%\n\nProFTPD exploit sold to Ransomware Inc for $12,500 (healthcare premium).\n\n- Victoria"
|
||||
|
||||
victoria_email_base64 = Base64.strict_encode64(victoria_email)
|
||||
%>
|
||||
|
||||
{
|
||||
"type": "email",
|
||||
"location": "executive_office_computer",
|
||||
"folder": "Drafts",
|
||||
"subject": "Q3 Pricing Update (Encoded)",
|
||||
"content": "<%= victoria_email_base64 %>",
|
||||
"observations": "Email draft is Base64-encoded. Decode to read contents."
|
||||
}
|
||||
```
|
||||
|
||||
**Correlation with VM:**
|
||||
- HTTP service flag revealed pricing intelligence
|
||||
- Base64 email shows actual pricing email
|
||||
- **CRITICAL:** Email confirms "$12,500 ProFTPD sale to Ransomware Inc"
|
||||
- Matches distcc operational log exactly
|
||||
|
||||
**Educational Value:**
|
||||
- Base64 (reinforced from M2)
|
||||
- Email forensics
|
||||
- Evidence corroboration (VM + in-game sources agree)
|
||||
|
||||
---
|
||||
|
||||
### Encoded Message 4: Double-Encoded USB
|
||||
|
||||
**Location:** Hidden USB in Victoria's desk drawer (lockpick required)
|
||||
|
||||
**ERB Template:**
|
||||
```erb
|
||||
<%
|
||||
architect_message_plain = "From: The Architect's Directives\n\nCipher, Future exploitation priorities for Q4:\n\n1. INFRASTRUCTURE EXPLOITS (PRIORITY)\n Focus on healthcare sector SCADA systems\n Energy grid ICS vulnerabilities\n\n2. CROSS-CELL COORDINATION\n Provide Ransomware Inc with hospital targeted economy packages\n\n3. OPERATIONAL SECURITY\n WhiteHat Security front must remain convinced\n Victoria Sterling authorized to recruit double agents\n\n- The Architect"
|
||||
|
||||
# Step 1: ROT13
|
||||
architect_message_rot13 = architect_message_plain.tr('A-Za-z', 'N-ZA-Mn-za-m')
|
||||
|
||||
# Step 2: Base64 (encode ROT13 output)
|
||||
architect_message_double = Base64.strict_encode64(architect_message_rot13)
|
||||
%>
|
||||
|
||||
{
|
||||
"type": "usb_drive",
|
||||
"name": "Encrypted USB Drive",
|
||||
"location": "executive_office_desk_drawer",
|
||||
"lockpick_difficulty": "medium",
|
||||
"contents": {
|
||||
"filename": "ARCHITECT_Q4_PRIORITIES.txt",
|
||||
"encoding": "Base64 (outer) + ROT13 (inner)",
|
||||
"content": "<%= architect_message_double %>",
|
||||
"observations": "USB drive contains double-encoded message. Decode Base64 first, then ROT13."
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**Correlation with VM:**
|
||||
- distcc log showed coordination between cells
|
||||
- Whiteboard mentioned "THE ARCHITECT"
|
||||
- **MAJOR REVEAL:** First direct communication from The Architect
|
||||
- References "Phase 2" (campaign arc setup)
|
||||
|
||||
**Educational Value:**
|
||||
- Multi-stage decoding (advanced)
|
||||
- Nested encoding patterns (Base64 outer, ROT13 inner)
|
||||
- Critical thinking (must decode in correct order)
|
||||
- Persistence (high-value intel requires effort)
|
||||
|
||||
---
|
||||
|
||||
## Integration Workflow
|
||||
|
||||
### Player Journey Flow
|
||||
|
||||
**Phase 1: Daytime Reconnaissance (In-Game Only)**
|
||||
1. Arrive at WhiteHat Security as potential client
|
||||
2. Meet Victoria Sterling (social engineering, RFID cloning)
|
||||
3. Optional: Meet James Park (office layout intel)
|
||||
4. Photograph whiteboard message (ROT13 - "THE ARCHITECT")
|
||||
5. Build trust with Victoria (alternative paths)
|
||||
6. Extract, plan nighttime infiltration
|
||||
|
||||
**Phase 2: Nighttime Infiltration (Hybrid: In-Game + VM)**
|
||||
7. Return after hours, navigate guard patrol (in-game stealth)
|
||||
8. Use cloned RFID card to access server room (in-game)
|
||||
9. Access VM terminal, scan network (VM: nmap)
|
||||
10. Submit flag{network_scan_complete} at drop-site (integration point)
|
||||
11. Banner grab FTP service (VM: netcat) → Submit flag{ftp_intel_gathered}
|
||||
12. HTTP analysis (VM: Base64 decode) → Submit flag{pricing_intel_decoded}
|
||||
13. Exploit distcc (VM: CVE-2004-2687) → Submit flag{distcc_legacy_compromised}
|
||||
14. Access unlocked workstation (in-game, unlocked by VM flags)
|
||||
15. Lockpick executive office, access Victoria's computer (in-game)
|
||||
16. Decode Hex client list using CyberChef (in-game)
|
||||
17. Decode Base64 email using CyberChef (in-game)
|
||||
18. Lockpick desk drawer, find USB drive (in-game)
|
||||
19. Decode double-encoded USB (ROT13+Base64) using CyberChef (in-game)
|
||||
|
||||
**Phase 3: Correlation & Choice (In-Game Only)**
|
||||
20. Correlate all evidence (VM flags + encoded messages)
|
||||
21. Realize M2 connection: ProFTPD exploit sold to Ghost
|
||||
22. Discover The Architect coordination pattern
|
||||
23. Optional: Protect James Park choice
|
||||
24. Victoria confrontation: Arrest vs. Double Agent choice
|
||||
25. Closing debrief with Agent 0x99
|
||||
|
||||
### Integration Points (VM → In-Game Unlocks)
|
||||
|
||||
| VM Flag Submission | In-Game Unlock |
|
||||
|--------------------|----------------|
|
||||
| `flag{network_scan_complete}` | Server room workstation access, nmap tutorial display |
|
||||
| `flag{ftp_intel_gathered}` | Client codename list document (correlates with Hex roster) |
|
||||
| `flag{pricing_intel_decoded}` | Pricing spreadsheet, LORE Fragment 2 safe accessibility |
|
||||
| `flag{distcc_legacy_compromised}` | **M2 connection reveal**, Agent 0x99 "aha moment" dialogue |
|
||||
|
||||
### Correlation Matrix
|
||||
|
||||
| Evidence Source | Type | Content | Correlates With |
|
||||
|-----------------|------|---------|-----------------|
|
||||
| FTP banner (VM) | Network | "GHOST" codename | Hex client list, distcc log |
|
||||
| distcc log (VM) | File | ProFTPD sale to Ransomware Inc | Base64 email, M2 mission |
|
||||
| ROT13 whiteboard (In-Game) | Physical | "THE ARCHITECT" mention | Double-encoded USB |
|
||||
| Hex client list (In-Game) | Digital | All ENTROPY cells listed | FTP banner, operational logs |
|
||||
| Base64 email (In-Game) | Digital | "$12,500 ProFTPD sale" | distcc log (exact match) |
|
||||
| Double-encoded USB (In-Game) | Digital | Architect's Q4 priorities | ROT13 whiteboard, coordination proof |
|
||||
|
||||
**Player Correlation Experience:**
|
||||
- Physical evidence (whiteboards, documents) + Digital evidence (VM flags) + Network evidence (banners, logs) all converge
|
||||
- Multiple sources confirm same facts (ProFTPD sale mentioned in distcc log AND Base64 email)
|
||||
- Pattern emerges: "All cells connected, The Architect coordinates, Zero Day supplies exploits"
|
||||
|
||||
---
|
||||
|
||||
## Educational Integration Approach
|
||||
|
||||
### Agent 0x99 Tutorial System
|
||||
|
||||
**RFID Cloning Tutorial (Pre-Mission Briefing):**
|
||||
```
|
||||
Agent 0x99: "Here's an RFID cloner. Corporate offices use RFID access control—keycards emit radio signals. When you meet Victoria, stay within 2 meters for 10 seconds. The cloner will copy her keycard signature. Watch the progress bar. If she walks away, you'll need to re-engage."
|
||||
```
|
||||
|
||||
**Network Reconnaissance Tutorial (Server Room):**
|
||||
```
|
||||
Agent 0x99: "Access the VM terminal. Start with nmap—it's the industry standard for network scanning. Target is 192.168.100.50. Look for open ports: 21 is FTP, 22 is SSH, 80 is HTTP. Service version detection (-sV flag) reveals what's running. Those services are ENTROPY dead drops—scan them, and you'll intercept their communications."
|
||||
```
|
||||
|
||||
**Banner Grabbing Tutorial (After Network Scan):**
|
||||
```
|
||||
Agent 0x99: "You've found open ports. Now use netcat to grab service banners. Connect to port 21: nc 192.168.100.50 21. Banners leak information—server versions, custom messages, sometimes even credentials. Zero Day uses banners for operational intelligence."
|
||||
```
|
||||
|
||||
**Encoding Tutorial (CyberChef Workstation):**
|
||||
```
|
||||
Agent 0x99: "CyberChef is on this workstation. It's the Swiss Army knife for encoding challenges. You'll see ROT13 (classical cipher), Hex (hexadecimal encoding), and Base64 (binary-to-text). Pattern recognition helps: ROT13 is all caps alphabetic, Hex is 0-9 and A-F pairs, Base64 ends with = padding. Start simple, work up to multi-stage."
|
||||
```
|
||||
|
||||
### In-Game Educational Feedback
|
||||
|
||||
**Drop-Site Terminal Educational Annotations:**
|
||||
```
|
||||
Network Scan Results (Annotated):
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
PORT SERVICE VERSION NOTES
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
21/tcp FTP vsftpd 3.0.3 File transfer (banner grab for intel)
|
||||
22/tcp SSH OpenSSH 7.4 Secure shell (password auth enabled)
|
||||
80/tcp HTTP Apache 2.4.6 Web server (check HTML source)
|
||||
3632/tcp distcc distccd v1 Legacy service (VULNERABLE!)
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
|
||||
ANALYSIS:
|
||||
- FTP (21): Connect with netcat for banner intelligence
|
||||
- HTTP (80): Fetch page, inspect HTML comments
|
||||
- distcc (3632): CVE-2004-2687 (Remote Code Execution)
|
||||
|
||||
NEXT STEPS: Banner grabbing → Service exploitation
|
||||
```
|
||||
|
||||
### CyberChef Workstation Hints
|
||||
|
||||
**ROT13 Hint (After 2 failed attempts):**
|
||||
```
|
||||
HINT: ROT13 is a Caesar cipher with 13-position rotation. All uppercase letters suggest classical cipher. Try the ROT13 operation in CyberChef.
|
||||
```
|
||||
|
||||
**Hex Hint (After 2 failed attempts):**
|
||||
```
|
||||
HINT: Hexadecimal uses 0-9 and A-F. Two-character pairs (4E 20 65) represent ASCII characters. Try "From Hex" operation in CyberChef.
|
||||
```
|
||||
|
||||
**Double-Encoding Hint (After 3 failed attempts):**
|
||||
```
|
||||
HINT: This message is encoded TWICE. Decode Base64 first, then decode the result with ROT13. Multi-stage encoding requires patient analysis.
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Technical Specifications
|
||||
|
||||
### Drop-Site Terminal Implementation
|
||||
|
||||
**Ink Script Structure:**
|
||||
```ink
|
||||
=== dropsite_terminal ===
|
||||
#speaker:system
|
||||
|
||||
Welcome to Intelligence Drop-Site Terminal.
|
||||
Submit intercepted ENTROPY communications for analysis.
|
||||
|
||||
* [Submit Flag: Network Scan]
|
||||
-> submit_network_scan_flag
|
||||
|
||||
* [Submit Flag: FTP Intelligence]
|
||||
-> submit_ftp_flag
|
||||
|
||||
* [Submit Flag: Pricing Intel]
|
||||
-> submit_pricing_flag
|
||||
|
||||
* [Submit Flag: distcc Compromise]
|
||||
-> submit_distcc_flag
|
||||
|
||||
* [Exit Terminal]
|
||||
-> DONE
|
||||
|
||||
=== submit_network_scan_flag ===
|
||||
Enter flag: {flag_network_scan_complete}
|
||||
|
||||
{
|
||||
- flag_network_scan_complete:
|
||||
FLAG VERIFIED: flag\{network_scan_complete\}
|
||||
|
||||
Network reconnaissance successful. Zero Day's infrastructure mapped.
|
||||
|
||||
UNLOCKED: Server room workstation access
|
||||
UNLOCKED: Educational network analysis display
|
||||
|
||||
#complete_task:submit_network_scan_flag
|
||||
#set_global:flag_network_scan_submitted:true
|
||||
#unlock_computer:server_room_workstation
|
||||
|
||||
-> dropsite_terminal
|
||||
|
||||
- else:
|
||||
INVALID FLAG. Verify flag format and retry.
|
||||
-> dropsite_terminal
|
||||
}
|
||||
```
|
||||
|
||||
### CyberChef Workstation Implementation
|
||||
|
||||
**Computer Object:**
|
||||
```json
|
||||
{
|
||||
"type": "workstation",
|
||||
"name": "CyberChef Analysis Workstation",
|
||||
"location": "server_room",
|
||||
"requires": "flag_network_scan_submitted",
|
||||
"tools": [
|
||||
{
|
||||
"name": "ROT13 Decoder",
|
||||
"operation": "rot13",
|
||||
"description": "Classical Caesar cipher with 13-position rotation"
|
||||
},
|
||||
{
|
||||
"name": "Hex Decoder",
|
||||
"operation": "from_hex",
|
||||
"description": "Hexadecimal to ASCII text conversion"
|
||||
},
|
||||
{
|
||||
"name": "Base64 Decoder",
|
||||
"operation": "from_base64",
|
||||
"description": "Base64-encoded text decoder"
|
||||
},
|
||||
{
|
||||
"name": "Multi-Stage Decoder",
|
||||
"operation": "custom",
|
||||
"description": "For nested encoding patterns (Base64 + ROT13)"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
### Global Variables Tracking
|
||||
|
||||
```json
|
||||
"globalVariables": {
|
||||
// VM Flag Submissions
|
||||
"flag_network_scan_submitted": false,
|
||||
"flag_ftp_intel_submitted": false,
|
||||
"flag_pricing_intel_submitted": false,
|
||||
"flag_distcc_submitted": false,
|
||||
|
||||
// In-Game Encoded Messages Decoded
|
||||
"decoded_rot13_whiteboard": false,
|
||||
"decoded_hex_client_list": false,
|
||||
"decoded_base64_email": false,
|
||||
"decoded_double_usb": false,
|
||||
|
||||
// Intelligence Correlation
|
||||
"m2_connection_revealed": false,
|
||||
"architect_discovered": false,
|
||||
"all_cells_identified": false,
|
||||
|
||||
// LORE Fragments
|
||||
"lore_client_roster_found": false,
|
||||
"lore_exploit_catalog_found": false,
|
||||
"lore_architect_directives_found": false,
|
||||
"lore_victoria_manifesto_found": false,
|
||||
|
||||
// NPC Trust
|
||||
"victoria_trust": 50,
|
||||
"james_trust": 30,
|
||||
|
||||
// Moral Choices
|
||||
"arrested_victoria": false,
|
||||
"became_double_agent": false,
|
||||
"protected_james": false,
|
||||
|
||||
// Mission Progress
|
||||
"rfid_card_cloned": false,
|
||||
"server_room_accessed": false,
|
||||
"evidence_collected": 0
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Success Metrics
|
||||
|
||||
### Technical Validation (VM Challenges)
|
||||
|
||||
**Player demonstrates competence in:**
|
||||
- ✅ Port scanning (nmap fundamentals)
|
||||
- ✅ Service enumeration (banner grabbing with netcat)
|
||||
- ✅ Service exploitation (distcc CVE-2004-2687)
|
||||
- ✅ Post-exploitation (file navigation, log analysis)
|
||||
|
||||
**CyBOK Areas Validated:**
|
||||
- NSS: Network reconnaissance
|
||||
- SS: Service exploitation, legacy systems
|
||||
- SOC: Intelligence gathering, systematic investigation
|
||||
|
||||
### Narrative Integration (ERB Content)
|
||||
|
||||
**Player experiences:**
|
||||
- ✅ Rich narrative context for technical challenges
|
||||
- ✅ Encoded message puzzles (ROT13, Hex, Base64, nested)
|
||||
- ✅ Intelligence correlation (physical + digital + network evidence)
|
||||
- ✅ Campaign arc progression (M2 connection, Architect discovery)
|
||||
- ✅ Meaningful choices (Victoria arrest/recruit, James protection)
|
||||
|
||||
**Educational Reinforcement:**
|
||||
- ACS: Multiple encoding types, pattern recognition
|
||||
- SOC: Evidence correlation, systematic analysis
|
||||
- HF: Social engineering, trust exploitation
|
||||
|
||||
### Hybrid Architecture Benefits
|
||||
|
||||
**For Players:**
|
||||
- VM challenges validate technical skills (consistent assessment)
|
||||
- ERB narrative makes challenges meaningful (story context)
|
||||
- Dead drop system creates satisfying progression (flags → unlocks)
|
||||
- Correlation moments feel earned (evidence from multiple sources)
|
||||
|
||||
**For Educators:**
|
||||
- Technical validation stable (VM unchanged)
|
||||
- Narrative updates easy (ERB flexibility)
|
||||
- CyBOK alignment clear (VM for technical, ERB for context)
|
||||
|
||||
**For Developers:**
|
||||
- VM separation reduces complexity (pre-built scenarios)
|
||||
- ERB templates enable rapid iteration (narrative changes)
|
||||
- Ink scripts handle complexity (NPC dialogues, tutorials)
|
||||
|
||||
---
|
||||
|
||||
## Quality Assurance
|
||||
|
||||
### Integration Testing
|
||||
|
||||
**Verify:**
|
||||
1. All VM flags submit correctly at drop-site terminal
|
||||
2. Flag submissions unlock corresponding in-game resources
|
||||
3. CyberChef workstation decodes all encoding types
|
||||
4. Global variables track progress accurately
|
||||
5. Correlation opportunities clear to players
|
||||
|
||||
**Test Cases:**
|
||||
- Submit flags out of order (should work, objectives track individually)
|
||||
- Decode in-game messages before submitting VM flags (should work, independent)
|
||||
- Skip optional content (Victoria social engineering path, James protection)
|
||||
- Complete perfect run (all flags, all LORE, all choices)
|
||||
|
||||
### Educational Validation
|
||||
|
||||
**Verify:**
|
||||
1. Agent 0x99 tutorials appear at correct moments
|
||||
2. CyberChef hints activate after failed attempts
|
||||
3. Drop-site terminal annotations clarify nmap output
|
||||
4. Correlation moments obvious (multiple sources point to same facts)
|
||||
|
||||
---
|
||||
|
||||
**Document Status:** ✅ COMPLETE
|
||||
**Stage 0 Status:** ✅ ALL DOCUMENTS COMPLETE (4/4)
|
||||
**Next Stage:** Stage 1 - Narrative Structure Development
|
||||
|
||||
---
|
||||
|
||||
## Stage 0 Completion Summary
|
||||
|
||||
### Documents Created (4/4):
|
||||
1. ✅ `00_scenario_initialization.md` (820 lines) - Mission framework
|
||||
2. ✅ `technical_challenges.md` (812 lines) - Challenge specifications
|
||||
3. ✅ `narrative_themes.md` (600+ lines) - Storytelling elements
|
||||
4. ✅ `hybrid_architecture_plan.md` (700+ lines) - VM + ERB integration
|
||||
|
||||
**Total:** ~2,900+ lines of Stage 0 documentation
|
||||
|
||||
### Ready for Stage 1:
|
||||
- Narrative structure development (scene-by-scene breakdown)
|
||||
- 3-act structure expansion (12-15 scenes)
|
||||
- Emotional arc mapping
|
||||
- Pacing chart design
|
||||
|
||||
---
|
||||
@@ -0,0 +1,608 @@
|
||||
# Mission 3: Narrative Themes
|
||||
|
||||
**Mission:** Ghost in the Machine
|
||||
**Stage:** 0 - Scenario Initialization
|
||||
**Document:** Narrative Themes and Storytelling Elements
|
||||
**Date:** 2025-12-24
|
||||
|
||||
---
|
||||
|
||||
## Recommended Theme: Corporate Espionage / Intelligence Gathering
|
||||
|
||||
**Logline:** A security consulting firm is a front for Zero Day Syndicate's exploit marketplace. Player must infiltrate undercover, clone an RFID keycard, scan the network, and intercept evidence linking them to the Mission 2 hospital ransomware attack before their cover is blown.
|
||||
|
||||
---
|
||||
|
||||
## Setting
|
||||
|
||||
### Location Type
|
||||
**WhiteHat Security Services** - Corporate Security Consulting Firm
|
||||
- Modern office building, 3rd floor suite
|
||||
- Professional corporate environment (conference rooms, executive offices, testing lab, server room)
|
||||
- Legitimate penetration testing services during the day
|
||||
- Criminal exploit brokerage operations hidden underneath
|
||||
|
||||
### Cover Story (Public Facade)
|
||||
|
||||
**What the public thinks:**
|
||||
> "WhiteHat Security Services provides enterprise penetration testing, vulnerability assessments, and security consulting for Fortune 500 companies. Founded in 2010, they've built a reputation for finding critical vulnerabilities before malicious actors do."
|
||||
|
||||
**Marketing materials claim:**
|
||||
- "Ethical Hacking Since 2010"
|
||||
- "We Find Vulnerabilities So Criminals Can't"
|
||||
- "Trusted by 200+ Enterprise Clients"
|
||||
- Professional website, client testimonials, industry conference speakers
|
||||
|
||||
**Legitimate employees believe:**
|
||||
- James Park (pen tester) genuinely does enterprise security audits
|
||||
- Receptionist handles scheduling for real corporate clients
|
||||
- Some operations ARE legitimate (cover for criminal activities)
|
||||
|
||||
### ENTROPY's Interest
|
||||
|
||||
**Why Zero Day Syndicate operates here:**
|
||||
1. **Legitimate Cover:** Real penetration testing business provides perfect facade
|
||||
2. **Technical Resources:** Access to latest vulnerability research, tools, infrastructure
|
||||
3. **Recruitment Pool:** Identify skilled hackers from legitimate industry
|
||||
4. **Client Base:** Existing relationships with corporations enable intelligence gathering
|
||||
5. **Financial Legitimacy:** Mix criminal exploit sales with real consulting revenue
|
||||
|
||||
**What they're actually doing:**
|
||||
- Researching and weaponizing zero-day vulnerabilities
|
||||
- Selling exploits to criminal organizations (Ransomware Inc, Critical Mass)
|
||||
- Coordinating with other ENTROPY cells under "The Architect"
|
||||
- Training operatives in network reconnaissance and exploitation
|
||||
- Maintaining systematic exploit catalog with pricing tiers
|
||||
|
||||
### Unique Atmosphere
|
||||
|
||||
**Daytime (Professional Corporate):**
|
||||
- Busy office environment, employees at workstations
|
||||
- Conference rooms with client meetings
|
||||
- Professional attire, corporate language
|
||||
- Legitimate security work happening
|
||||
- Victoria Sterling playing the role of sales lead
|
||||
- Coffee machines, motivational posters, clean modern design
|
||||
|
||||
**Nighttime (Espionage Thriller):**
|
||||
- Quiet, dimly lit hallways
|
||||
- Single security guard patrol
|
||||
- Player sneaking through offices
|
||||
- Tense atmosphere—risk of discovery
|
||||
- Evidence of criminal operations visible when legitimate employees absent
|
||||
- Server room humming, terminals glowing in darkness
|
||||
|
||||
**Contrast Creates Tension:**
|
||||
- Same location, two different faces (day vs night)
|
||||
- Corporate professionalism hiding criminal enterprise
|
||||
- Innocent employees unknowingly working alongside criminals
|
||||
- Player must maintain cover during daytime, exploit absence at night
|
||||
|
||||
---
|
||||
|
||||
## Inciting Incident
|
||||
|
||||
### Discovery
|
||||
|
||||
**Three weeks before the mission:**
|
||||
SAFETYNET intelligence analyst flags unusual patterns in ENTROPY communications intercepts:
|
||||
- Multiple cells referencing "contractor" providing exploits
|
||||
- Financial transactions showing payments to shell company "WhiteHat Security Services"
|
||||
- Encrypted communications mentioning "Zero Day procurement"
|
||||
|
||||
**Two weeks before:**
|
||||
Mission 2 debrief reveals ProFTPD exploit (CVE-2010-4652) used in hospital ransomware.
|
||||
- Ghost (Ransomware Incorporated) obtained exploit from external source
|
||||
- Payment of $12,500 traced to shell company linked to WhiteHat Security
|
||||
- SAFETYNET realizes Zero Day Syndicate is ENTROPY's central exploit supplier
|
||||
|
||||
**One week before:**
|
||||
SAFETYNET plants digital surveillance on WhiteHat's training network:
|
||||
- Network traffic reveals systematic vulnerability scanning
|
||||
- Training exercises use real exploits against simulated targets
|
||||
- Communications reference "The Architect" issuing priorities
|
||||
|
||||
**Mission Trigger:**
|
||||
SAFETYNET intercepts encrypted message:
|
||||
> "Q4 priorities from The Architect: Infrastructure exploits. Healthcare SCADA. Cross-cell coordination packages ready for delivery."
|
||||
|
||||
Intelligence indicates Zero Day is about to supply exploits for major ENTROPY operation. Player must infiltrate, gather evidence, and either:
|
||||
- **Disrupt:** Arrest Victoria Sterling, seize exploit catalog (immediate impact, long-term intelligence lost)
|
||||
- **Exploit:** Recruit Victoria as double agent, maintain intelligence feeds (long-term gain, immediate risk)
|
||||
|
||||
### Why Player Is Sent In
|
||||
|
||||
**SAFETYNET's Objectives:**
|
||||
1. **Confirm Identity:** Is WhiteHat Security actually Zero Day Syndicate front?
|
||||
2. **Gather Evidence:** Client lists, exploit catalogs, financial records
|
||||
3. **Prove Coordination:** Find evidence of "The Architect" directing cells
|
||||
4. **Trace M2 Connection:** Confirm Zero Day sold hospital ransomware exploit
|
||||
5. **Strategic Decision:** Arrest Victoria (disrupt) OR recruit as double agent (long-term intel)
|
||||
|
||||
**Player's Cover:**
|
||||
- Pose as corporate client seeking penetration testing services
|
||||
- Daytime reconnaissance under legitimate business pretense
|
||||
- Nighttime infiltration after hours to access restricted areas
|
||||
- Maintain cover story if detected: "Working late with Victoria's authorization"
|
||||
|
||||
---
|
||||
|
||||
## Stakes
|
||||
|
||||
### Personal Stakes
|
||||
|
||||
**Innocent Employee (James Park):**
|
||||
- 29-year-old penetration tester, OSCP certified
|
||||
- Genuinely believes he works for legitimate security firm
|
||||
- Unaware of criminal operations
|
||||
- **Moral Dilemma:** If player exposes entire firm, James faces arrest despite innocence
|
||||
- **Player Choice:** Protect James (document his innocence) OR focus solely on mission
|
||||
|
||||
**Victoria Sterling:**
|
||||
- True believer in "vulnerability marketplace" ideology
|
||||
- Built WhiteHat Security from ground up (mix of legitimate and criminal)
|
||||
- Sees herself as researcher and consultant, not criminal
|
||||
- **Personal Stakes:** Career, freedom, ideological validation
|
||||
- **If Arrested:** Loses everything, refuses cooperation
|
||||
- **If Recruited:** Maintains cover, becomes SAFETYNET asset
|
||||
|
||||
**Zero Day Operatives:**
|
||||
- Skilled security researchers who chose criminal path
|
||||
- Believe they're "leveling the playing field" against government surveillance
|
||||
- Ideologically committed to free-market vulnerability disclosure
|
||||
- **Stakes:** Criminal prosecution, ENTROPY network exposure
|
||||
|
||||
### Organizational Stakes
|
||||
|
||||
**SAFETYNET:**
|
||||
- **If Mission Succeeds:** Evidence of ENTROPY coordination confirmed, "The Architect" identified as real threat
|
||||
- **If Cover Blown:** Zero Day alerted, intelligence opportunity lost, other cells warned
|
||||
- **Strategic Choice:** Short-term disruption (arrest) vs. long-term intelligence (double agent)
|
||||
|
||||
**Zero Day Syndicate:**
|
||||
- **If Exposed:** Exploit supply chain disrupted, revenue lost, operatives arrested
|
||||
- **If Player Becomes Double Agent:** Risk of feeding SAFETYNET intelligence, but maintain operations
|
||||
|
||||
**ENTROPY Network:**
|
||||
- **If Zero Day Disrupted:** Other cells lose central exploit supplier, operations delayed
|
||||
- **If Coordination Proven:** SAFETYNET shifts strategy from targeting individual cells to hunting "The Architect"
|
||||
|
||||
### Societal Stakes
|
||||
|
||||
**Immediate Impact:**
|
||||
- Zero Day supplies exploits for healthcare SCADA attacks (Critical Mass operations)
|
||||
- Exploits enable ransomware targeting hospitals (Ransomware Incorporated)
|
||||
- Financial sector exploits sold to Crypto Anarchists
|
||||
|
||||
**Long-Term Impact:**
|
||||
- If arrested: Exploit marketplace disrupted, cybercriminals lose reliable supplier
|
||||
- If double agent: SAFETYNET gains inside view of vulnerability black market, can preemptively patch exploits
|
||||
- **Ethical Complexity:** Is it worth letting criminal operation continue to gather long-term intelligence?
|
||||
|
||||
**Campaign Stakes:**
|
||||
- Mission 3 confirms ENTROPY cells are coordinated network under "The Architect"
|
||||
- Discovery shifts SAFETYNET strategy from reactive (individual cell disruption) to proactive (hunting coordinator)
|
||||
- Sets up Missions 4-9: Investigation of The Architect's identity and Phase 2 plans
|
||||
|
||||
### Urgency
|
||||
|
||||
**Time Pressure:**
|
||||
- Q4 priorities indicate major ENTROPY operation imminent
|
||||
- Healthcare SCADA exploits being prepared for Critical Mass (Mission 4 setup)
|
||||
- Window of opportunity: Victoria expects "client visit" (player's cover) this week
|
||||
- Nighttime infiltration limited: Security guard patrol, need to complete before dawn shift change
|
||||
|
||||
**Mission Timer (Optional):**
|
||||
- If detected twice: 5-minute timer to complete mission before backup arrives
|
||||
- Must make Victoria choice before dawn: Arrest now OR establish double agent relationship
|
||||
|
||||
---
|
||||
|
||||
## Central Conflict
|
||||
|
||||
### Player vs. Zero Day Syndicate
|
||||
|
||||
**Player's Goal:** Gather evidence of ENTROPY coordination, prove M2 connection, disrupt exploit supply chain
|
||||
|
||||
**Zero Day's Goal:** Maintain legitimate cover, supply exploits to ENTROPY cells, avoid detection
|
||||
|
||||
**Conflict Layers:**
|
||||
1. **Stealth Challenge:** Infiltrate without detection (guard patrol, Victoria's suspicion)
|
||||
2. **Technical Challenge:** Scan network, exploit vulnerabilities, decode intelligence
|
||||
3. **Social Challenge:** Maintain cover story, build/exploit trust with Victoria
|
||||
4. **Moral Challenge:** Arrest Victoria (justice, disruption) vs. recruit as double agent (intelligence, risk)
|
||||
5. **Collateral Challenge:** Protect innocent James Park vs. focus solely on mission
|
||||
|
||||
### Player vs. Victoria Sterling
|
||||
|
||||
**Victoria's Ideology:** Free market of vulnerabilities, no moral responsibility for client use
|
||||
> "We provide tools. What clients do with them isn't our concern. Governments weaponize zero-days daily—we simply level the playing field."
|
||||
|
||||
**Player's Challenge:**
|
||||
- Victoria is intelligent, charismatic, ideologically committed
|
||||
- She won't cooperate if arrested (true believer, not opportunist)
|
||||
- Double agent recruitment requires demonstrating value, shared interests
|
||||
- Player must navigate her free-market ideology vs. SAFETYNET's mission
|
||||
|
||||
**Ideological Battle:**
|
||||
- Victoria: "Information asymmetry is market value. Security is economic problem."
|
||||
- Player must counter with: Exploit sales enable real harm (M2 hospital deaths)
|
||||
- Victoria's response: "Hospital chose $3.2M MRI over $85K security. Their choice, not mine."
|
||||
- No easy moral victory—Victoria has internally consistent worldview
|
||||
|
||||
### Player vs. The Architect (Background)
|
||||
|
||||
**The Architect's Presence:**
|
||||
- Never physically present, only referenced in communications
|
||||
- Directs Zero Day's priorities (infrastructure exploits, cross-cell coordination)
|
||||
- Sets quota: $850K Q4 revenue, 15% goes to "coordination fund"
|
||||
- Authorizes Victoria to recruit double agents (foreshadowing player choice)
|
||||
|
||||
**Player's Discovery:**
|
||||
- First direct communication from The Architect found in double-encoded USB
|
||||
- Confirms ENTROPY is coordinated hierarchy, not loose network
|
||||
- References "Phase 2" (future operations, setting up M7-9 arc)
|
||||
- Player realizes: Individual cell disruption won't stop ENTROPY—must find Architect
|
||||
|
||||
---
|
||||
|
||||
## Narrative Arc Preview
|
||||
|
||||
### Act 1: Undercover Infiltration (20-30%)
|
||||
|
||||
**Player Discovers:**
|
||||
- WhiteHat Security appears legitimate on surface
|
||||
- Victoria Sterling is professional, convincing sales lead
|
||||
- Office environment feels corporate, employees seem normal
|
||||
- **Twist:** Small details hint at something deeper (encrypted whiteboard messages, client codenames)
|
||||
|
||||
**Key Scenes:**
|
||||
1. **Opening Briefing:** Agent 0x99 briefs undercover operation, provides RFID cloner
|
||||
2. **Daytime Arrival:** Player poses as corporate client, meets Victoria
|
||||
3. **Office Tour:** Victoria shows "training network" (actually criminal infrastructure)
|
||||
4. **RFID Cloning:** 10-second proximity window during conversation
|
||||
5. **Optional James Interaction:** Innocent employee provides intel, unaware of criminal operations
|
||||
6. **Extraction:** Leave office, regroup with Agent 0x99, plan nighttime infiltration
|
||||
|
||||
**Emotional Beat:** Player feels professional corporate environment could be legitimate—maybe SAFETYNET intelligence is wrong?
|
||||
|
||||
### Act 2: Investigation & Escalation (50-55%)
|
||||
|
||||
**Player Investigates:**
|
||||
- Nighttime infiltration reveals darker reality
|
||||
- Evidence mounts: Client lists, exploit catalogs, pricing spreadsheets
|
||||
- Network reconnaissance exposes training environment for criminal exploits
|
||||
- Encoded messages reveal ENTROPY coordination
|
||||
|
||||
**Key Scenes:**
|
||||
7. **Nighttime Infiltration:** Tense stealth through darkened office, guard patrol
|
||||
8. **Server Room Access:** Use cloned RFID card, access VM terminal
|
||||
9. **Network Reconnaissance:** Scan Zero Day's training network (nmap, netcat, distcc)
|
||||
10. **Evidence Collection:** Decode ROT13 whiteboard, Hex client list, Base64 email, double-encoded USB
|
||||
11. **Correlation Moment:** Physical evidence + VM flags + encoded messages converge
|
||||
12. **Major Revelation:** ProFTPD exploit (CVE-2010-4652) sold to Ghost for $12,500—M2 connection!
|
||||
13. **Architect Discovery:** Double-encoded USB reveals first direct communication from The Architect
|
||||
|
||||
**Emotional Beat:** Player transitions from uncertainty → suspicion → conviction → shock (M2 connection) → dread (The Architect coordination)
|
||||
|
||||
### Act 3: Climax & Choice (20-25%)
|
||||
|
||||
**Player Confronts:**
|
||||
- Victoria discovers infiltration (or player reveals identity)
|
||||
- Evidence is overwhelming—no denying criminal operations
|
||||
- Victoria offers recruitment: "You're skilled. Join us, or arrest me and lose insight forever."
|
||||
- Player must choose: Arrest (justice, disruption) vs. Double Agent (intelligence, risk)
|
||||
- Optional: Protect James Park from collateral damage
|
||||
|
||||
**Key Scenes:**
|
||||
14. **Optional James Discovery:** Realize innocent employee will be collateral if entire firm exposed
|
||||
15. **James Choice:** Protect James (document innocence, warn him) OR focus on mission
|
||||
16. **Victoria Confrontation:** Direct dialogue, ideological battle, recruitment offer
|
||||
17. **Major Choice:** Arrest Victoria OR become double agent
|
||||
18. **Closing Debrief:** Agent 0x99 reviews outcomes, acknowledges choices, sets up campaign arc
|
||||
|
||||
**Emotional Beat:** Player grapples with moral complexity—no "right" answer. Arrest feels just but loses long-term intelligence. Double agent feels pragmatic but leaves criminal operation running.
|
||||
|
||||
---
|
||||
|
||||
## Key NPCs and Characterization
|
||||
|
||||
### Victoria "Vick" Sterling (Antagonist / Double Agent Candidate)
|
||||
|
||||
**Background:**
|
||||
- Age: 38
|
||||
- Former NSA contractor (TAO division), left after Snowden leaks
|
||||
- MIT Sloan MBA, specialization in risk management
|
||||
- Founded WhiteHat Security in 2010 (mix of legitimate and criminal)
|
||||
- Zero Day Syndicate sales lead, reports to "Cipher" (cell leader)
|
||||
|
||||
**Personality:**
|
||||
- Professional, charismatic, calculating
|
||||
- True believer in free-market vulnerability disclosure
|
||||
- Sees herself as researcher and consultant, not criminal
|
||||
- Ideologically committed (won't cooperate if arrested out of opportunism)
|
||||
- Respects competence (if player demonstrates skill, considers recruitment)
|
||||
|
||||
**Philosophy:**
|
||||
- "Information asymmetry is market value. Vulnerabilities exist. They have value. We monetize them."
|
||||
- "Security is an economic problem, not a moral one. We don't cause failures—we reveal them."
|
||||
- "Governments weaponize zero-days. Corporations hoard vulnerabilities. We level the playing field."
|
||||
- No moral responsibility for how clients use exploits: "I don't control what they do. That's their burden."
|
||||
|
||||
**Voice Examples:**
|
||||
|
||||
**Professional Corporate (Daytime):**
|
||||
> "Welcome to WhiteHat Security. We specialize in enterprise penetration testing—finding vulnerabilities before malicious actors do. Our methodology is comprehensive: reconnaissance, exploitation, post-exploitation, and reporting. What's your organization's security posture?"
|
||||
|
||||
**True Believer (Nighttime Confrontation):**
|
||||
> "You think this is evil? Look at St. Catherine's Hospital. They chose a $3.2 million MRI over an $85,000 security upgrade. THEY gambled with patient safety. We just made the stakes visible. If they'd listened to their IT admin, those patients would be alive. That's not my fault—that's theirs."
|
||||
|
||||
**Recruitment Pitch (Act 3 Choice):**
|
||||
> "You're skilled. I respect that. SAFETYNET pays you what—$90K? $120K? I made $850K last year. The Architect values competence. Join us, or arrest me and lose the only insight you'll ever have into ENTROPY's coordination. Your choice."
|
||||
|
||||
**Dialogue Patterns:**
|
||||
- Uses corporate consulting language as armor ("ROI," "risk assessment," "market dynamics")
|
||||
- Deflects moral arguments with economic logic
|
||||
- Respects competence, dismisses idealism
|
||||
- If arrested: Refuses cooperation (ideologically committed, not opportunist)
|
||||
- If recruited: Pragmatic about double agent role—sees it as game, not betrayal
|
||||
|
||||
**Character Arc:**
|
||||
- Starts as professional consultant facade
|
||||
- Mid-mission: Mask slips, ideological commitment visible
|
||||
- End: Either arrested (defiant, uncooperative) OR recruited (pragmatic partnership)
|
||||
|
||||
---
|
||||
|
||||
### James Park (Innocent Employee / Moral Complexity)
|
||||
|
||||
**Background:**
|
||||
- Age: 29
|
||||
- OSCP certified penetration tester, 3 years at WhiteHat
|
||||
- Genuinely believes WhiteHat is legitimate security firm
|
||||
- Conducts real penetration tests for enterprise clients
|
||||
- Unaware of criminal operations (compartmentalization)
|
||||
|
||||
**Personality:**
|
||||
- Enthusiastic, technical, naive
|
||||
- Proud of his work (ethical hacking, helping companies secure systems)
|
||||
- Trusts Victoria (sees her as mentor)
|
||||
- Would be horrified if he knew about criminal clients
|
||||
|
||||
**Function in Narrative:**
|
||||
- **Information Source:** Provides office layout, schedules, technical details during daytime
|
||||
- **Moral Complexity:** Represents collateral damage of exposing entire firm
|
||||
- **Player Choice Catalyst:** Discovering James is innocent forces decision: protect him or prioritize mission
|
||||
|
||||
**Voice Examples:**
|
||||
|
||||
**Daytime (Enthusiastic Pen Tester):**
|
||||
> "WhiteHat's a great place to work. Victoria's mentoring me on client relations. Last week we did a full pentest for a Fortune 500—found three criticals they didn't know about. Felt good, you know? Actually helping companies stay secure."
|
||||
|
||||
**If Warned (Shocked Realization):**
|
||||
> "Wait, what? Criminal exploits? That's not... I mean, we do legitimate security work. I've seen the client contracts. Victoria's professional. She wouldn't... Are you serious? Oh god, I had no idea."
|
||||
|
||||
**Dialogue Patterns:**
|
||||
- Technical enthusiasm (excited about security work)
|
||||
- Trust in Victoria and company mission
|
||||
- Small talk about office environment (useful intel)
|
||||
- If warned: Shock, denial, horror (identity crisis)
|
||||
|
||||
**Character Arc:**
|
||||
- Starts as helpful innocent providing intel
|
||||
- Mid-mission: Player discovers James's innocence
|
||||
- End: Either protected (player documents innocence, warns him) OR collateral (arrested with criminals)
|
||||
|
||||
**Moral Weight:**
|
||||
- James represents cost of disruption—innocent caught in crossfire
|
||||
- Player must choose: perfect mission vs. protecting innocent
|
||||
- No mechanical benefit to protecting James (pure moral choice)
|
||||
|
||||
---
|
||||
|
||||
### "Cipher" (Zero Day Syndicate Cell Leader - Referenced)
|
||||
|
||||
**Background:**
|
||||
- Zero Day Syndicate cell leader
|
||||
- Identity unknown (not present in M3)
|
||||
- Reports to "The Architect"
|
||||
- Manages exploit catalog, recruitment, operations
|
||||
|
||||
**Presence in Mission:**
|
||||
- Email subject lines: "Per Cipher's approval: Q3 pricing update"
|
||||
- Operational logs: "Cipher authorized ProFTPD sale to external cell"
|
||||
- Victoria's dialogue: "I report to Cipher. They handle strategic decisions."
|
||||
|
||||
**Purpose:**
|
||||
- Establish Zero Day hierarchy (Victoria is sales lead, not cell leader)
|
||||
- Build mystery for potential future mission (M6-M10 could feature Cipher directly)
|
||||
- Show command structure: Cipher → Victoria → operatives
|
||||
|
||||
**Character Hints:**
|
||||
- Technical expert (approves exploit quality)
|
||||
- Strategic thinker (coordinates with Architect)
|
||||
- Cautious (doesn't appear in person at WhiteHat office)
|
||||
|
||||
---
|
||||
|
||||
### Agent 0x99 (SAFETYNET Handler)
|
||||
|
||||
**Role:** Mission briefing, tutorial support, closing debrief
|
||||
|
||||
**Function:**
|
||||
- **Opening Briefing:** Explains undercover operation, provides RFID cloner device
|
||||
- **RFID Tutorial:** Teaches proximity cloning mechanics
|
||||
- **Network Reconnaissance Tutorial:** Explains nmap basics, port scanning fundamentals
|
||||
- **Mid-Mission Support:** Context-sensitive hints (if player struggles)
|
||||
- **Closing Debrief:** Reviews choices, reveals campaign implications
|
||||
|
||||
**Voice:** Professional intelligence officer, tactical guidance, non-judgmental about player choices
|
||||
|
||||
**Debrief Examples:**
|
||||
|
||||
**If Arrested Victoria:**
|
||||
> "You arrested Victoria Sterling. Bold move. Zero Day Syndicate's sales operations are disrupted—we've seized the exploit catalog. But Victoria refuses to cooperate. True believer. Cipher will rebuild, but you've bought us time. Good work."
|
||||
|
||||
**If Recruited Victoria:**
|
||||
> "You've established Victoria as a double agent. Risky, but potentially invaluable. We'll feed her disinformation, track Zero Day's operations long-term. If she discovers you're SAFETYNET... well, you know the risks. Play the long game."
|
||||
|
||||
**Campaign Arc Framing:**
|
||||
> "This changes everything. Zero Day Syndicate sold the ProFTPD exploit used in Mission 2's hospital attack. ENTROPY isn't a loose network. They're coordinated. Someone called The Architect is pulling the strings. Your mission is evolving—we're not just disrupting cells anymore. We're hunting the coordinator."
|
||||
|
||||
---
|
||||
|
||||
## Tone and Atmosphere
|
||||
|
||||
### Overall Tone: Espionage Thriller with Cybersecurity Education
|
||||
|
||||
**Primary Influences:**
|
||||
- Corporate espionage films (Michael Clayton, Margin Call)
|
||||
- Undercover operation tension (The Departed, Tinker Tailor Soldier Spy)
|
||||
- Cybersecurity realism (Mr. Robot, Blackhat)
|
||||
|
||||
**Not:**
|
||||
- Action-heavy (no gunfights, car chases)
|
||||
- Overly campy (grounded, professional)
|
||||
- Purely technical (character-driven with technical validation)
|
||||
|
||||
### Daytime Atmosphere: Corporate Professional
|
||||
|
||||
**Visual:**
|
||||
- Bright, modern office (glass conference rooms, ergonomic workstations)
|
||||
- Employees in business casual, laptops open, coffee cups
|
||||
- WhiteHat Security branding (professional logo, motivational posters)
|
||||
- Clean, organized environment
|
||||
|
||||
**Audio:**
|
||||
- Keyboard typing, phone conversations (muffled)
|
||||
- Coffee machine brewing, office small talk
|
||||
- Victoria's professional sales pitch
|
||||
- Background hum of legitimate business
|
||||
|
||||
**Emotional:**
|
||||
- Player feels professional, corporate environment (seems legitimate)
|
||||
- Victoria is convincing (good at her cover)
|
||||
- Small details feel "off" (encrypted whiteboard, client codenames)
|
||||
- Building suspicion: "Is this really a criminal operation?"
|
||||
|
||||
### Nighttime Atmosphere: Espionage Tension
|
||||
|
||||
**Visual:**
|
||||
- Dimly lit hallways (emergency lighting, computer screen glow)
|
||||
- Empty desks, dark conference rooms
|
||||
- Server room humming with activity
|
||||
- Security guard flashlight sweeping hallway
|
||||
|
||||
**Audio:**
|
||||
- Player's footsteps (quiet, deliberate)
|
||||
- Guard radio chatter (distant)
|
||||
- Server fans, hard drive whirring
|
||||
- Tense silence between patrol passes
|
||||
|
||||
**Emotional:**
|
||||
- High tension (risk of detection)
|
||||
- Stealth gameplay (timing guard patrol)
|
||||
- Discovery excitement (finding evidence)
|
||||
- Mounting dread (evidence confirms worst fears)
|
||||
|
||||
### Discovery Moments: Intellectual Satisfaction
|
||||
|
||||
**When Decoding ROT13 Whiteboard:**
|
||||
- "MEET WITH THE ARCHITECT - PRIORITIZE INFRASTRUCTURE EXPLOITS"
|
||||
- Player feels: "Wait... The Architect is REAL?"
|
||||
|
||||
**When Reading Hex Client List:**
|
||||
- "Ransomware Incorporated, Critical Mass, Social Fabric..."
|
||||
- Player feels: "All the cells are CONNECTED?"
|
||||
|
||||
**When Discovering M2 Connection:**
|
||||
- "ProFTPD exploit sold to Ransomware Inc for $12,500"
|
||||
- Player feels: "ZERO DAY SOLD THE HOSPITAL EXPLOIT!"
|
||||
|
||||
**Educational Moments: Guided Discovery**
|
||||
- Agent 0x99 tutorials feel like mentor guidance
|
||||
- Network reconnaissance teaches real skills (nmap, netcat)
|
||||
- Encoding puzzles require thinking, not guessing
|
||||
- VM challenges validate technical competence
|
||||
|
||||
---
|
||||
|
||||
## Why This Theme Works
|
||||
|
||||
### Supports Technical Challenges
|
||||
|
||||
**RFID Cloning:**
|
||||
- Corporate office naturally has RFID access control
|
||||
- Victoria wears executive keycard (logical cloning target)
|
||||
- Server room requires RFID (motivation for cloning)
|
||||
|
||||
**Network Reconnaissance:**
|
||||
- Zero Day operates "training network" (narrative context for VM scanning)
|
||||
- nmap, netcat, distcc challenges fit security consulting cover
|
||||
- Flags represent intercepted ENTROPY communications
|
||||
|
||||
**Multi-Encoding:**
|
||||
- Security firm naturally uses encoding (operational security)
|
||||
- Whiteboard messages (ROT13), client files (Hex), emails (Base64) feel organic
|
||||
- Double-encoded USB (ROT13+Base64) represents high-value intel
|
||||
|
||||
**Social Engineering:**
|
||||
- Corporate environment rewards trust-building
|
||||
- Victoria responds to competence demonstration
|
||||
- James provides intel if treated professionally
|
||||
|
||||
**Stealth:**
|
||||
- Nighttime infiltration creates tension
|
||||
- Guard patrol natural for corporate security
|
||||
- Daytime/nighttime contrast reinforces undercover operation
|
||||
|
||||
### Creates Emotional Stakes
|
||||
|
||||
**Personal:** James Park's innocence, Victoria's ideology
|
||||
**Organizational:** SAFETYNET vs. Zero Day vs. The Architect
|
||||
**Societal:** Exploit marketplace enables harm (M2 hospital, future attacks)
|
||||
|
||||
**Moral Complexity:** No easy answers
|
||||
- Arrest: Just but loses intelligence
|
||||
- Double Agent: Pragmatic but morally ambiguous
|
||||
- James: Protect innocent vs. mission efficiency
|
||||
|
||||
### Fits Break Escape Universe
|
||||
|
||||
**Establishes:**
|
||||
- ENTROPY cells are coordinated (not independent)
|
||||
- The Architect is real coordinator (not myth)
|
||||
- Zero Day is central exploit supplier (connects all cells)
|
||||
|
||||
**Connects:**
|
||||
- M1: Social Fabric appears in client list
|
||||
- M2: ProFTPD exploit sale revealed (major "aha moment")
|
||||
- M4: Critical Mass client (SCADA exploits)
|
||||
- M6: Crypto Anarchists reference (financial exploits)
|
||||
- M7-9: The Architect hunt (campaign arc)
|
||||
|
||||
### Supports Player Agency
|
||||
|
||||
**Meaningful Choices:**
|
||||
1. **Victoria:** Arrest vs. Double Agent (strategic consequences)
|
||||
2. **James:** Protect vs. Ignore (moral consequences)
|
||||
3. **Approach:** Social engineering vs. Stealth vs. Hybrid
|
||||
|
||||
**Multiple Playstyles:**
|
||||
- High trust path (Victoria grants access, skip RFID cloning)
|
||||
- Stealth path (timing guards, lockpicking, RFID cloning)
|
||||
- Hybrid path (mix approaches)
|
||||
|
||||
**Replayability:**
|
||||
- Different Victoria choice outcomes
|
||||
- Discovering all LORE fragments
|
||||
- Perfect stealth run
|
||||
- Speedrun optimization
|
||||
|
||||
---
|
||||
|
||||
**Document Status:** ✅ COMPLETE
|
||||
**Next Document:** hybrid_architecture_plan.md
|
||||
**Integration:** Ready for Stage 1 (Narrative Structure Development)
|
||||
|
||||
---
|
||||
Reference in New Issue
Block a user