OWASP Security Shepherd
OWASP Security Shepherd is a web and mobile application security training platform. Security Shepherd has been designed to foster and improve security awareness among a varied skill-set demographic. The aim of this project is to take AppSec novices or experienced engineers and sharpen their penetration testing skillset to security expert status.
| Feature | Details |
|---|---|
| Wide Topic Coverage | Shepherd includes more than seventy levels across the entire spectrum of Web and mobile application security - within a single project. |
| Gentle Learning Curve | Shepherd is a perfect entry point for users completely new to security, with levels increasing in difficulty at a manageable pace. |
| Layman Write Ups | Each security concept, when first addressed in Shepherd, is presented using plain language, so it can be readily understood by beginners. |
| Real World Examples | The security risks in Shepherd are real vulnerabilities that have had their exploit impact dampened to protect the application, users and environment. There are no simulated security risks which require an expected, specific attack vector in order to pass a level. Attack vectors when used on Shepherd are how they would behave in the real world. |
| Scalability | Shepherd can be used locally by a single user or easily as a server for a high amount of users. |
| Highly Customisable | Shepherd enables admins to set what levels are available to their users and in what way they are presented (Open, CTF and Tournament Layouts) |
| Perfect for Classrooms | Shepherd gives its players user specific solution keys to prevent students from sharing keys, rather than going through the steps required to complete a level. |
| Scoreboard | Security Shepherd has a configurable scoreboard to encourage a competitive learning environment. Users that complete levels first, second and third get medals on their scoreboard entry and bonus points to keep things entertaining on the scoreboard. |
| User Management | Security Shepherd admins can create users, create admins, suspend, unsuspend, add bonus points or take penalty points away user accounts with the admin user management controls. Admins can also segment their students into specific class groups. Admins can view the progress a class has made to identify struggling participants. An admin can even close public registration and manually create users if they wish for a private experience. |
| Localisation Support | Security Shepherd material is available in multiple languages from a single instance. Students with alternative language preferences can compete in the same Shepherd instance as others without issue. |
| Robust Service | Shepherd has been used to run online CTFs such as the OWASP Global CTF and OWASP LATAM Tour CTF 2015, both surpassing 200 active users and running with no downtime, bar planned maintenance periods. |
| Configurable Feedback | An administrator can enable a feedback process, which must be completed by users before a level is marked as complete. This is used both to facilitate project improvements based on feedback submitted and for system administrators to collect “Reports of Understanding” from their students. |
| Granular Logging | The logs reported by Security Shepherd are highly detailed and descriptive, but not screen blinding. If a user is misbehaving, you will know. |
Project Resources
Project Information
Flagship Project
Classification
Training
Language
Java
License
GNU General Public License v3.0
Latest Version
3.1
Contributors
75
GitHub Stars
1459
Downloads
1162320
OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.
SlackOWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.
© 2026, OWASP Foundation Inc. All rights reserved.