OWASP Security Shepherd is a guided web and mobile application security training platform with progressive lessons, challenge modes, user management, and classroom features. This guide builds the current repository, starts its three-service Docker environment, verifies the browser endpoint, and records the first administrator login.
What is OWASP Security Shepherd?
Security Shepherd is an OWASP training platform rather than one isolated vulnerable page. It contains progressively harder web and mobile security lessons, guided explanations, challenge modes, scoring, and administrator controls for classrooms or individual practice.
The maintained repository currently builds the application with Maven and then starts a Docker Compose environment containing the application, MariaDB, and MongoDB. The older downloadable VM remains useful for historical labs, but the repository build is the better default for a current installation.
Download, install, run and test OWASP Security Shepherd
Security Shepherd is a web and mobile application security training platform. Its current source setup must first generate the WAR file, database scripts and certificates, and only then build and start the Docker services. The commands below perform that complete sequence.
Ubuntu: complete Bash installation
Open a Bash terminal and paste the full block. It installs every required package, downloads the current project or image, starts the lab, tests the web service, and prints the browser address.
RHEL, Rocky Linux or AlmaLinux: complete Bash installation
Open Bash and paste the full block. These commands use and the Docker RHEL repository.
Windows 10 or 11: complete cmd.exe installation
Open Command Prompt as Administrator. The first block installs Docker Desktop. If Windows requests a restart, restart, reopen , and paste the same block again.
Security Shepherd combines platform setup with guided exercises. Use the first visual to confirm the environment, then review the second as context for the web and API behaviors explained in the first-session walkthrough.
A good first Security Shepherd session
Change the default administrator password first. Then create a learner account and enable a small starter set rather than every module at once. Begin with authentication, session handling, input validation, and introductory injection lessons. The platform is most effective when the learner reads the concept, attempts the challenge, and then writes down the defensive control.
For CSRF 1 and CSRF 2, pay attention to the difference between a browser automatically sending ambient credentials and an application verifying that a state-changing request was intentionally created by the user. For SQL injection, focus on parameterized queries and server-side validation rather than memorizing strings.
Troubleshooting that actually helps
| Problem | What to check | Fix |
|---|---|---|
| Maven build fails immediately | Java and Maven versions | Run |
| Compose cannot find application artifacts | Maven build completion | Run |
| Port 80 is occupied | Existing web server | Stop the existing service or change the host port in the Compose configuration. |
| Default login does not work | Database initialization | Check service logs and wait until the database and application containers are healthy. |
How Ammune helps with production risks represented by Security Shepherd
Security Shepherd teaches SQL injection, CSRF, XSS, authentication, authorization, session, and mobile security concepts. Ammune can connect these lessons to production API telemetry without treating the lab as a direct substitute for secure design.
Build an inventory from observed traffic and show which endpoints, methods, parameters, and response fields are actually in use.
Inspect both sides of an API transaction so analysts can see the input, returned data, status, identity context, and related behavior.
Turn suspicious API activity into risk-ranked, SIEM-ready evidence that can support monitoring, investigation, and carefully controlled enforcement.
| Training weakness | Production API risk | How Ammune can help |
|---|---|---|
| SQL injection and unsafe input | A request parameter reaches a database or interpreter without safe handling. | Inspect request payloads and endpoint behavior, flag suspicious structures, and provide the original transaction to analysts. |
| CSRF and state-changing requests | A browser is induced to send an authenticated action the user did not intend. | Surface unusual state-changing request patterns and origin, header, identity, and session context; anti-CSRF design remains essential. |
| Broken authentication and access control | Credentials, sessions, roles, or object checks are weak. | Correlate identity and endpoint behavior to identify unusual login sequences, privileged function access, or cross-user object activity. |
| Training-to-SOC handoff | A classroom finding must become an operational detection use case. | Translate the lesson into SIEM-ready events, risk scoring, forensic context, and a controlled monitoring or enforcement policy. |
Related Ammune guidance: API authorization vs authentication API security incident response playbook Centralized SIEM log forwarding OWASP Juice Shop Docker installation and login guide
Verified project sources
The tutorial above is complete; these links are included for release history, project ownership, and future verification—not because you need to leave this page to finish the installation.
Frequently asked questions
Who is Security Shepherd designed for?
It supports beginners, experienced engineers, classrooms and competitive training through progressively harder web and mobile lessons.
Why does Security Shepherd generate user-specific solution keys?
User-specific keys reduce answer sharing and require each learner to complete the intended exercise.
What training modes are available?
Administrators can configure open learning, capture-the-flag and tournament-style experiences.
Why is the initial administrator password temporary?
The default credential exists only for first access and should be changed immediately when the application prompts for it.
What can instructors monitor?
Administrators can manage users and classes, track progress, control available levels and review detailed training logs.
How does Ammune extend the production lesson?
Ammune observes live API behavior, sensitive data and identity context so application-security lessons can become operational SOC signals.
Apply the lessons from OWASP Security Shepherd to real API traffic
Ammune helps security, DevSecOps, and SOC teams discover APIs, inspect requests and responses, identify abuse and data exposure, and turn runtime evidence into practical investigation or enforcement workflows.