doAttack and legalAttacks