SQL Injection Defense Training

Welcome, WAF Analyst. You've been handed the last hour's traffic log for a batch of endpoints. Some requests are SQL injection attacks. Some just look suspicious but are legitimate customer traffic. Your job is to write a detection ruleset that blocks every attack in the batch without blocking a single legitimate request.

• Each round: Read a batch of real HTTP requests (query params / POST bodies), each already labeled Attack or Benign for training purposes.
• Your tool: A rule editor. Type one detection pattern per line, in JavaScript regex form (e.g. /union\s*select/i). Any request matching ANY of your patterns gets BLOCKED.
• Test Ruleset: Run your patterns against the whole batch as many times as you want. See exactly which requests you'd block and allow.
• Deploy Ruleset: Locks in your patterns. You only pass the round if EVERY attack is blocked and ZERO benign requests are blocked. A rule too broad (blocks a real customer) or too narrow (misses an attack) gets rejected with the exact request that broke it.
• Goal: Ship a clean ruleset across all 5 batches. Your ruleset carries forward round to round, like a real WAF policy.