My attacker script is the “make trouble” tool, it repeatedly sends a POST that pretends to be the heart monitor (HM-123) but with an intentionally fake JWT. The goal is to prove the gateway is actually checking identity and policy, not just IPs: when the fake token hits the gateway you’ll see DENIED_SPOOFING or 401 in the logs and the dashboard lights up in red, while the real heart monitor stays green and uninterrupted. I tweak the attack cadence and payload so the demo is dramatic but controlled, and I tie this script to the dashboard’s button so I can trigger the spoof live and walk the judges through what’s happening.
Log in or sign up for Devpost to join the conversation.