OWASP Security Shepherd
Yes. It's free and open source, under the GNU General Public License v3.
This means you're free to use Security Shepherd for any purpose, including training inside your own organisation, and to run it on your own servers for as many players as you like.
You can also change it however you want: reskin it (see below) with your own branding, add or remove levels, translate it, or fork the project.
The one condition comes if you distribute a modified version to others: you must then share its source code under the same licence. Running it for your own players doesn't count as distributing it.
This is a summary, not legal advice, so see the licence text, linked below, for the details.
Many training apps are built for one person learning on their own. Shepherd is also built for teaching: instructors can group players into classes, choose which levels are open and how they're presented, give every player their own result keys, and run a live scoreboard. It also covers web and mobile application security in one platform.
The source is on GitHub. The current release, 3.1, is on the GitHub releases page. To run version 4.0, which is in development, build it from source as Getting started describes.
Docker Hub has the 3.1 image, tagged latest, and development builds of 4.0, tagged dev and 4.0.0-SNAPSHOT.
Getting started, linked below, takes you through the setup. To build and run it, you need:
GitJDK 17Maven 3.9.2or newerDocker, withDocker Compose
Yes, that's what it's designed for. Running a CTF, linked below, explains how to prepare the server, choose the levels and layout, set up classes and run the scoreboard.
Security Shepherd is deliberately vulnerable. Run it on a network used only for training, keep the unsafe levels closed unless the server is isolated, and change the default passwords before anyone else uses it.
Yes, from version 4.0. Security Shepherd supports SAML single sign-on, so players can log in through your organisation's identity provider. SSO is off by default. Logins have to start from Security Shepherd's login page: logging in from your identity provider's dashboard isn't supported. Single sign-on, linked below, explains how to set it up.
Yes. Running a CTF, linked below, explains which files hold the logo and styles, and how to rebuild the image with your changes.
A web browser and an intercepting proxy, such as ZAP or Burp Suite. Both come with an integrated browser.
The mobile levels will need an Android setup.
If you're playing at an event, ask the organisers. Admins can see a cheat sheet for every level.
If you're running Shepherd yourself, you're the admin. Go to Admin → Configuration → Cheat Sheet Management, click Enable Cheat Sheets for Administrators, and reload the page. A Cheat button appears in the left menu and shows how to complete the level that's open.
At an event, don't enable cheat sheets for all users, because that gives every player the answers.
Project Information
Requirements
- Docker with Docker Compose
- JDK 17 and Maven 3.9.2+ to build
Slack