Kosa
Kosa is an agentic Attack/Defense CTF toolkit.
Core trick
Replays observed flag-stealing requests as candidate exploits, validating patches against the live checker before gated deployment.
Description
Kosa is an agentic Attack/Defense CTF toolkit.
In a typical eight-hour ad ctf, a team has to repeat the same loop every minute: watch scoreboard, inspect suspicious network flows, reconstruct working exploits, patch vulnerable services without breaking the checker, and attack dozens of other teams before they fix the bug. At that pace, the challenge becomes less about individual hacking skill and more about keeping the whole workflow synchronized.
Kosa wraps that loop around a Claude Opus 4.7 dispatcher. It ingests scoreboards from FAUST, Enoflag, and ATKLAB; consumes traffic from Tulip, pcaps, and JSON logs; reconstructs exploit candidates from observed flag-stealing flows; proposes patches; validates them against the live checker; and deploys through gated approval. Every action is auditable and constrained by explicit allowlists.
Kosa supports two modes: manual mode, where Kosa acts as a dashboard and gated submitter, and autonomous mode, where the dispatcher drives the loop end to end. It is designed to complement existing A/D tooling such as Tulip for traffic capture and Ataka for exploit farming, rather than replacing them.
Kosa also ships with a fully Dockerized three-team A/D lab, letting you run the entire workflow locally in about five minutes.
README excerpt
# Kosa **Agentic Attack/Defense CTF toolkit.** Kosa watches a scoreboard, ingests live traffic, reconstructs exploit candidates from real flag-stealing requests, proposes patches, deploys them with human approval, and can replay approved exploits back at allowlisted targets — all wrapped around a Claude-powered orchestrator that runs the loop end-to-end. Built during a hackathon. Comes with a fully Dockerized local A/D lab so you can see the whole loop run on your laptop in under five minutes — no remote infrastructure, no signups. --- ## Why this exists Attack/Defense CTFs reward teams that can do four things at once, every five minutes, for eight hours straight: 1. Read scoreboard deltas and notice *which* service started leaking flags. 2. Pull suspicious flows from network traffic and turn them into a working PoC. 3. Patch the service without breaking the checker (false positives = SLA loss). 4. Replay the now-understood exploit at the other 30 teams before they patch. That is a coordination problem more than a hacking problem. Kosa is an attempt to give one operator the leverage of a small team by letting an LLM do the boring pattern-matching parts and letting the human drive the decisions that matter (deploy? submit? replay?). The interesting question for the judges is the same one we kept asking ourselves: *how much of the A/D loop can you actually automate before the autonomy starts hurting your score?* Kosa is structured so you can dial the autonomy slider you