OWASP Security Shepherd¶

Security Shepherd is a web and mobile application security training platform. It helps people of any skill level, from AppSec beginners to experienced engineers, build their penetration testing skills.

The source code, issues and releases are on GitHub. New to Security Shepherd? Start with Getting started.

Playing¶

• How Shepherd works: lessons and challenges, layouts, result keys and scoring
• Setting up your tools: an intercepting proxy and your browser
• The levels: every web level, by topic
• Mobile levels: the Android levels

Running Security Shepherd¶

• Deploying into production: passwords, TLS certificates and the network, before other people use it
• Upgrading: up-to-date images, and moving an installation to 4.0
• Backups and restore: what to back up, and how to restore it
• Running a CTF: set up levels, classes, the scoreboard and rules for an event
• Admin menu reference: every page in the Admin menu
• Single sign-on: log players in through your organisation's SAML identity provider
• Translations: languages, and adding a translation
• Troubleshooting: common problems and where the logs are
• Verifying the images: where an image came from and what's inside it
• Vulnerability management: how vulnerabilities in the platform are handled, and how to scan an image

Reference¶

• Configuration: .env, the properties files and the settings in the database
• Glossary: the terms used in Security Shepherd

Contributing¶

• Development workflow: branches, pull requests and formatting
• Running tests: unit and integration tests
• Database layer: how Security Shepherd connects to its databases
• Releasing: how a release is cut and published

These pages are built from the docs/ folder. To change one, open a pull request against dev.