一句话：提出面向网络安全教育的故障注入工具 FETT，可向 Django 应用可复现地注入 OWASP 风格漏洞。
针对网络安全教育常依赖抽象理论或过于简单示例的问题，本文提出 FETT，一个面向教育者与学生的故障注入工具。FETT 通过用户友好的界面和模块化漏洞注入机制，以定向、可复现的方式向现有 Django Web 应用注入由 OWASP Top 10:2021 启发的漏洞，同时保持目标应用核心功能运行。作者在五个公开 GitHub 项目和六个近三学年（2022-2024）的学生项目上评估 FETT，能够高效注入漏洞并维持应用可用性。工具已开源并提供演示，旨在连接安全理论与实践。
In this paper, we present FETT, a fault injection tool for educational and training purposes addressed to educators and students in cybersecurity. Our tool aims to analyze and inject vulnerabilities into existing Django web applications for educational purposes. Indeed, security education often relies on either abstract theoretical instruction or overly simplistic examples. This tool bridges the gap between theory and practice by modifying real web applications in a targeted, reproducible way. With its user-friendly interface and modular vulnerability injection, instructors can create challenges tailored to specific learning goals, while students engage directly with code that simulates production-level vulnerabilities. We evaluated FETT based on five publicly available GitHub projects and six student projects from the last three academic years (2022-2024). We successfully managed to efficiently inject vulnerabilities inspired by the OWASP top 10:2021 while keeping the core functionalities of the target application operational. The project is publicly available at https://gitlab.com/fabgilson/django-vulnerability-injector. A demonstration is available at https://youtu.be/ZYQs2vLzbyE.
@inproceedings{paperbot9276,
title = {FETT: Fault Injection as an Educational and Training Tool in Cybersecurity},
author = {Anaé De Baets and Guillaume Nguyen and Xavier Devroey and Fabian Gilson},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00367}
}