Refine
Year of publication
- 2022 (1)
Document Type
Language
- English (1)
Has Fulltext
- no (1)
Is part of the Bibliography
- no (1)
Institute
SQL injections are one of the most widely used techniques to attack data-driven applications. Thus, the potential for cyber-attacks increases consistently.
To create awareness of hacker attacks, we demonstrate a web-based educational game. The game shows how SQL injections work and which kind of attacks they enable, e.g., logging in without knowing a user's password, deleting data or retrieving secret or sensitive data. At each level, the players have to fill out login or search forms or use URL parameters to attack an example retail website. While solving these tasks, players can look at the SQL query and the application code. The players learn how SQL injections work, how dangerous they are, and how to make their own applications more robust against SQL injections, for example by using prepared statements.