Learn to hack – but for the right reasons: On the road at the Democracy Days in Wismar and Halle

 

At the end of August, we traveled with Mint Secure for two days across two German states: on August 26 at the Theater der Hansestadt Wismar and on August 27 at the Salinenmuseum in Halle (Saale). The occasion was the “Democracy Days” event under the motto “My Vote Counts! Experience, Shape, and Celebrate Democracy!”—a program designed by students for students and jointly organized by the Chair of Social Ethics at the University of Bonn, the Federal Student Conference and the GermanDream Education Initiative was organized.

The timing was no coincidence. In Mecklenburg-Western Pomerania, a new state parliament will be elected on September 20, 2026; in Saxony-Anhalt, the election already took place on September 6. Many of the young people in the audience on those two days will be voting for the first time—or are about to. We found the idea of launching a format right during this time window—one that doesn’t just explain democracy but makes it a tangible experience—convincing even before we were given the go-ahead. After those two days, we were even more convinced.

Our Workshop: What Hacking Actually Means

Felix and Tim from our team We held the workshop “Learn to Hack! But for the Good Guys” at both locations—each time for a group of 10th and 11th graders, lasting about 90 minutes, with significantly more live demos than slide presentations.

We started with a question that has a surprisingly large number of answers: What exactly is hacking? The image most people have comes from movies and the news—hoodies, dark rooms, crime. But the core meaning of the term is actually quite different. A “hack” is, first and foremost, a technical trick. Hacking is the creative, inventive use of technology: an expansion of functionality, a solution to a problem, or simply a goal achieved through an unconventional method. The fact that, alongside malicious motives, there is also ethical hacking—and that it is a profession in its own right—was new to some members of the group.

Before things got technical, we discussed the Hacker Ethics as used, for example, by the as formulated by the Chaos Computer Club. A few of these points were of particular interest to the students:

• Access to computers and everything that can show us how this world works should be unlimited and complete.
• Use public data, protect private data.
• Distrust authorities—promote decentralization.
• Judge a hacker by what they do, not by their appearance, age, background, gender, or social status.
• Don’t rummage through other people’s data.

And we have made it clear what the legal requirements are: Everything we show is intended for learning and teaching purposes regarding one’s own systems. Unauthorized use may constitute a criminal offense (as we ourselves have often noticed). With great power comes great responsibility—a cliché, but simply true in this context.

From Theory to the Hack Lab

Next, we moved on to the technical aspects. First, we built a web application—client, front end, back end, database—as a shared model that we could refer back to repeatedly later on. Then came the question: How do you actually attack a website? Gather information, launch an attack. Our own, intentionally vulnerable web store in the Hack Lab served as a testing ground, which the groups were initially allowed to explore on their own. The ideas that came from the audience on both days were surprisingly good.

In terms of content, we then worked our way through the classics:

• Account Hacking
  Username enumeration—that is, discovering valid usernames because an application is too chatty in its responses. And brute-force or dictionary attacks on passwords, demonstrated live using Hydra. The subsequent overview of how long it takes to brute-force a password, depending on its length and character set, conveys more about strong passwords in one minute than any fact sheet—and turns the discussion about password managers into something more than just a lecture.
• IDOR (Insecure Direct Object Reference)
  The “attack” consists of incrementing a number in the URL—and then suddenly seeing someone else’s order. No special knowledge, no tools, just a close look. This is where “Don’t dig through other people’s data” came into play.
• Cross-Site-Scripting (XSS) It starts off harmless: embedding your own HTML into a page, then an image. Next comes the next step—what cookies are, what sessions are used for, and what happens when someone steals a session cookie. Experience has shown that the live demo—in which we inject a payload into an article and then take over someone else’s account—is the moment when an abstract security topic becomes something very tangible.

Finally, a look ahead at what we didn’t have time to cover in 90 minutes: SQL injection, SSRF, broken access control, CSRF, clickjacking, path traversal—plus tips on where you can legally practice on your own. A few teenagers stayed behind afterward and wanted to know how one actually ends up working in this field. For us, conversations like these are the real reward of a workshop, and we’re grateful to be able to share our knowledge in this setting.

Why Democracy and Cybersecurity Go Hand in Hand

 

 

 

 

 

 

A Day with Many Voices

As much as we’re attached to our own format, the best part of both days was the surrounding atmosphere. Each day kicked off with a plenary session featuring three short presentations. What was remarkable about this was the format: no lectures on democracy, but personal stories. How does one even come to get involved? When did you first realize that your own voice makes a difference—and what do you do with the feeling that it isn’t making a difference right now? The speakers shared stories from student council work, educational initiatives, and climate activism—honest accounts, perfectly paced for an audience of 15- and 16-year-olds. The effect was palpable: democracy was presented not as an institution, but as something people do.

The workshop program was also remarkably diverse, and it was striking how different the approaches to the same topic could be. Some of the formats took an artistic approach: rap and graffiti as a way to give expression to a stance, or movement and bodywork as a starting point for exploring when one dares to become visible. Other formats took a discursive approach: a dialogue on values in which young people sorted through and weighed their own core beliefs against one another; a workshop exploring what actually shapes one’s identity; and a session on dealing with fake news that provided hands-on practice in verifying and evaluating sources. Still others focused on games and shifts in perspective—board games as models for negotiation processes, or a format that had young people design “screenshots from the future” and thus ask themselves what kind of society they actually want to live in. In addition, there was a workshop on taking action itself: How do I turn an opinion into concrete action? And for the accompanying teachers, there was a separate program on teaching democracy in the classroom.

We found the common thread in the content of all the workshops compelling: None of them were about teaching the young people the “right” opinion, but rather about equipping them with tools—artistic, rhetorical, and technical—that they can use to find and express their own positions. Our hacking workshop fit into this framework better than we would have thought beforehand.

In the afternoon, the debate session took place: Students discussed deliberately polarizing questions in pairs, each time with limited time and rotating discussion partners. The format isn’t about being right, but about being able to justify a position and remain in dialogue despite disagreement—a skill that’s difficult to teach theoretically and was simply practiced here. The event concluded with a group concert. The organizers’ thematic arc—listen, reflect, experience, celebrate—truly came together over the course of both days.

A Day with Many Voices

What stuck with us most was the atmosphere. Open, respectful, and curious—without the heaviness that such topics often bring. The young people came with genuine questions; the organizing team prepared very well for both days and still managed to pull it off in a relaxed manner; and among the speakers, the tone was collegial and engaging. During the breaks and at lunch, conversations arose that we’d love to continue—with people from political education, academia, and cultural work who are working on topics completely different from ours but who share the same question in mind: How do you truly reach young people?

We love to connect with others. If you work at a school, in an initiative, or in an educational setting and would like to offer a hacking workshop, a presentation, or a live hacking session—please reach out to us. And if you’ve come across any of the other formats of the Democracy Days: The colleagues there are doing outstanding work that deserves much more recognition.

A big thank you goes to the Democracy Day team, the University of Bonn, the Federal Student Conference, and GermanDream for the invitation and the organization—and to the students in Wismar and Halle, who really challenged us with their questions. We’d love to come back.

How Mint Secure Makes a Difference

Don’t just take the system’s word for it—check for yourself. This approach protects both computers and democracy alike.

Mint Secure GmbH