OWASP Security Shepherd
Each topic starts with a lesson, like this one on SQL injection
Security Shepherd has 82 lessons and challenges. Each topic starts with a lesson that explains the vulnerability in plain language, followed by challenges that get harder as you go.
Web: cross-site scripting (XSS), cross-site request forgery (CSRF), injection (SQL, NoSQL and XXE), session management, insecure direct object references, insecure cryptographic storage, failure to restrict URL access, poor data validation, security misconfiguration, and unvalidated redirects and forwards.
Mobile (Android): insecure data storage, broken cryptography, reverse engineering, data leakage, poor authentication, injection, content providers, and security decisions via untrusted input.
Shepherd is a good starting point if you're new to security, and still a challenge for professionals. Levels rise in difficulty at a manageable pace, and each concept is introduced in plain language the first time it comes up.
The vulnerabilities are real rather than simulated, so attacks behave as they would in the real world. Their impact is contained, apart from the optional unsafe levels, which should only be opened on an isolated server.
The scoreboard during an event
Admins choose which levels are open and how they're presented, in one of three layouts described below. Every player gets their own result keys, so answers can't simply be shared, and the scoreboard awards medals and bonus points to the first players to complete each level.
Players can be grouped into classes, with a progress view to spot anyone who's struggling, and admins can require a feedback form before a level counts as complete. User management covers creating players and admins, suspending accounts and adjusting points, and registration can be closed for private events.
Switching layouts from the admin menu
Admins choose how the levels are presented to players.
CTF Mode. Players see one level at a time, starting with the easiest, and move on by completing it. Best for guided training, where everyone follows the same path.
Open Floor Mode. Every open level is available, grouped by topic with the lessons first. Best for exploring at your own pace.
Tournament Mode. Every open level is available, grouped by difficulty from easiest to hardest. Best for competitions.
Shepherd runs on anything from a single laptop to an online event with hundreds of players. It has hosted the OWASP Global CTF and the OWASP LATAM Tour CTF 2015, each with more than 200 active players.
The interface is available in several languages, though the translations are still in progress, and detailed logs show you if a player is misbehaving.
Project Information
Requirements
- Docker with Docker Compose
- JDK 17 and Maven 3.9.2+ to build
Slack