Skip to content

The levels

This page lists every level in Security Shepherd 4.0: 58 web levels and 24 mobile levels, in 18 topics. It shows what each level is worth and where it sits in Tournament Mode, but not how to complete it.

Organisers choose which levels are open, so your event may have fewer. Within a topic, the levels are listed from easiest to hardest.

Before you start

  • Unsafe levels. The levels marked (unsafe) make the server itself vulnerable, so they're closed unless the organiser opens them on an isolated server.
  • NoSQL Injection One needs MongoDB, which the organiser turns on during setup.
  • The CSRF challenges are only completed when another logged-in player triggers the request you forged, so you'll need someone else's help.
  • The mobile levels need an Android emulator. They're listed on Mobile levels.

Web levels

Insecure direct object references

Level Kind Points Tournament band
Insecure Direct Object References Lesson 10 Field Training
Insecure Direct Object Reference Challenge 1 Challenge 35 Private
Insecure Direct Object Reference Challenge 2 Challenge 65 Sergeant
Insecure Direct Object Reference Bank Challenge 60 Lieutenant

Poor data validation

Level Kind Points Tournament band
Poor Data Validation Lesson 10 Field Training
Poor Data Validation 1 Challenge 35 Private
Poor Data Validation 2 Challenge 80 Major

Security misconfiguration

Level Kind Points Tournament band
Security Misconfiguration Lesson 10 Field Training
Security Misconfig Cookie Flag Challenge 110 Admiral

Session management

Level Kind Points Tournament band
Broken Session Management Lesson 10 Field Training
Session Management Challenge 1 Challenge 40 Private
Session Management Challenge 2 Challenge 55 Sergeant
Session Management Challenge 3 Challenge 60 Sergeant
Session Management Challenge 4 Challenge 75 Major
Session Management Challenge 5 Challenge 110 Admiral
Session Management Challenge 6 Challenge 110 Admiral
Session Management Challenge 7 Challenge 110 Admiral
Session Management Challenge 8 Challenge 115 Admiral

Failure to restrict URL access

Level Kind Points Tournament band
Failure to Restrict URL Access Lesson 15 Field Training
Failure to Restrict URL Access 1 Challenge 40 Private
Failure to Restrict URL Access 2 Challenge 85 Major
Failure to Restrict URL Access 3 Challenge 110 Admiral

Cross-site scripting (XSS)

Level Kind Points Tournament band
Cross Site Scripting Lesson 15 Field Training
Cross Site Scripting 1 Challenge 20 Field Training
Cross Site Scripting 2 Challenge 60 Sergeant
Cross Site Scripting 3 Challenge 65 Sergeant
Cross Site Scripting 4 Challenge 75 Major
Cross Site Scripting 5 Challenge 85 Major
Cross Site Scripting 6 Challenge 95 Admiral

Insecure cryptographic storage

Level Kind Points Tournament band
Insecure Cryptographic Storage Lesson 25 Private
Insecure Cryptographic Storage Challenge 1 Challenge 35 Private
Insecure Cryptographic Storage Challenge 2 Challenge 65 Sergeant
Insecure Cryptographic Storage Challenge 3 Challenge 75 Major
Insecure Cryptographic Storage Challenge 4 Challenge 115 Admiral
Insecure Cryptographic Storage Home Made Key Challenge 140 Admiral

Injection

Level Kind Points Tournament band
SQL Injection Lesson 30 Private
XXE Injection (unsafe) Lesson 30 Private
XXE Injection 1 (unsafe) Challenge 40 Private
SQL Injection 1 Challenge 35 Private
SQL Injection 2 Challenge 45 Corporal
NoSQL Injection One Challenge 45 Corporal
SQL Injection Escaping Challenge 50 Corporal
SQL Injection 3 Challenge 70 Lieutenant
SQL Injection 4 Challenge 75 Major
SQL Injection 5 Challenge 90 Admiral
SQL Injection Stored Procedure Challenge 90 Admiral
SQL Injection 6 Challenge 95 Admiral
SQL Injection 7 Challenge 110 Admiral

Cross-site request forgery (CSRF)

Level Kind Points Tournament band
Cross Site Request Forgery Lesson 40 Private
CSRF 1 Challenge 55 Sergeant
CSRF 2 Challenge 70 Lieutenant
CSRF 3 Challenge 70 Lieutenant
CSRF 4 Challenge 70 Lieutenant
CSRF JSON Challenge 70 Lieutenant
CSRF 5 Challenge 80 Major
CSRF 6 Challenge 90 Admiral
CSRF 7 Challenge 120 Admiral

Unvalidated redirects and forwards

Level Kind Points Tournament band
Unvalidated Redirects and Forwards Lesson 45 Corporal