Query Breaker Lab

Query Breaker Lab is a local teaching CTF built with Flask and SQLite. It shows how unsafe SQL string construction can lead to authentication bypass and how parameterized queries prevent this problem.

Environment

conda activate comp6441-ctf

You can also recreate the environment by running:

.\scripts\bootstrap.ps1

Database

flask --app ctf_app reset-db

Run

python run.py

Open http://127.0.0.1:5000 in a browser.

Test

pytest -q

The following script resets the database and runs the tests:

.\scripts\check.ps1

Learning flow

1. Trigger a database error in vulnerable mode and examine the error message.
2. Bypass authentication and retrieve the protected flag.
3. Compare vulnerable and secure behavior, then identify the root cause and primary defense.

Teaching materials

• Player guide
• Instructor guide
• Solution
• Local run and verification record