Glossary¶

Terms used in Security Shepherd and in these pages.

Term	Meaning
Admin	A user who can see the Admin menu: configure Security Shepherd, open and close levels, and manage players. See Admin menu reference.
Bonus points	Extra points for the first five players in a class to complete a level: 5 for the first, down to 1 for the fifth.
Category	See topic.
Challenge	A level that tests a vulnerability without instructions. Challenges get harder within a topic.
Cheat sheet	The steps to complete a level. Admins can turn cheat sheets on for admins or for everyone, which adds a Cheat button to the menu.
Class	A group of players, such as the players at one event. Medals and bonus points are awarded per class, and the scoreboard can show one class only.
CTF Mode	A layout in which each player sees one level at a time, from easiest to hardest.
Feedback	A short form about a level that players fill in before it's marked as complete, when an admin has turned it on.
Layout	How levels are presented to players: Open Floor, CTF Mode or Tournament Mode. See How Shepherd works.
Lesson	A level that explains a vulnerability and gives a small application to try it on. Each topic starts with one.
Level	A lesson or a challenge. Security Shepherd's pages also call them modules.
Medal	Gold, silver or bronze, for the first three players in a class to complete a level. Shown on the scoreboard.
Mobile level	A level whose vulnerability is in an Android app. See Mobile levels.
Module	See level.
Module block	A level that admins have blocked, with a message to players. In CTF Mode, players can't go past it.
Open Floor	A layout in which every open level is available, grouped by topic.
Player	A user who plays the levels, without access to the Admin menu.
Result key	The text a level gives you when you complete it. Submit it to score the level. Many levels give each player a key of their own.
Setup token	A random value in `conf/SecurityShepherd.auth` that the setup page asks for, to prove you can reach the server's files.
Topic	A kind of vulnerability, such as SQL injection or cross-site scripting, with a lesson and usually several challenges. Security Shepherd's pages also call it a category.
Tournament band	One of the difficulty groups in Tournament Mode: Field Training, Private, Corporal, Sergeant, Lieutenant, Major and Admiral.
Tournament Mode	A layout in which every open level is available, grouped into tournament bands from easiest to hardest.
Unsafe level	A level that makes the server itself vulnerable: XXE Injection and XXE Injection 1. They're closed unless an admin opens them, which should only be done on an isolated server.