Strengthening Database Security with Capture the Flag Exercises

Database security has a key role when protecting websites and other IT services. Attacks against databases could result in the leak of confidential data or integrity related security issues. One of the best options to protect services that utilize databases is to simulate real attacks against these. This paper focuses on capture the flag (CTF) style attack simulation and compare existing CTF challenges in the field of database security. The aim was to map the existing databases weaknesses and vulnerabilities into CTF style problems and help penetration testers to understand different attack scenarios against services with database connections. We identified several database related vulnerabilities that are usually not covered by CTF style challenges and a discussion is made how these missing fields could be added to the most well-known offensive security exercises.