Mark Denihan Sean Duggan - OWASP Security Shepherd

## Overview

OWASP Security Shepherd is an educational platform created by Mark Denihan and Sean Duggan to teach application security to students. Mark developed the project as a final year project at Dublin Institute of Technology after undertaking a pentesting internship at IBM under Jason Fl, where he struggled to find learning resources geared toward students rather than experienced practitioners. Sean, a year behind Mark in his studies, joined the effort to expand Security Shepherd into mobile platforms as his own final year project. The platform was designed to address a significant gap in computer science education, as top courses in the USA do not adequately cover application security.

## Technical Architecture

Security Shepherd runs on a straightforward stack: Tomcat application server (handling up to 1,700 concurrent users with default settings), MySQL database, ESAPI for encoding, Anti-Samy for XSS prevention, and OWASP CSRFGuard. Every vulnerability implemented is real but with restricted privileges—users complete challenges with credentials that only access the specific level, preventing them from compromising the broader platform. For vulnerabilities like cross-site scripting where real detection is difficult without browser virtualization, Anti-Samy is deployed instead.

## Educational Methodology

The platform employs a graduated learning approach. When students encounter a topic for the first time, they receive a comprehensive lesson written in layman's terms, followed by a simple challenge that essentially walks them through the solution. As progression continues, each subsequent challenge provides less help and introduces bad fixes (security implementations with flaws), forcing students to deepen their understanding. Students learn that reading lessons is necessary to progress, and the reinforcement of concepts through increasingly complex variations is effective—particularly for difficult topics like CSRF.

## CSRF Teaching Example

The CSRF progression demonstrates this approach: Level 1 introduces image-tag attacks with simulated immediate execution; Level 2 escalates to POST requests using iframes; Level 4 introduces weak CSRF tokens that are highly predictable (only values 0, 1, 2), requiring students to send multiple requests to guarantee success. This real-world reflection of broken protections is significantly more effective than theoretical lectures.

## Gamification and Administration

Administrators can enable leaderboards and point systems, where students gain points for completing levels with bonus points for first completion. This gamification dramatically increases engagement, though it sometimes shifts focus from learning to competition. To prevent cheating, keys are user-specific—encrypted with the user's username and a random base key—so sharing answers fails. Administrators can configure the experience granularly: enable/disable module categories, set module blocks to pause progression, provide or hide cheat sheets, and view real-time student progress to identify those struggling.

## Mobile Security (Mobile Shepherd)

Sean created Mobile Shepherd by packaging vulnerable Android applications on Android x86 VirtualBox images. This approach avoids requiring individual app downloads, Android SDK setup, or reliance on slow emulators. Mobile levels cover insecure storage (plain-text credentials in SQLite databases), client-side injection (SQL injection in login fields), and reverse engineering (extracting hardcoded keys from APK files using dex2jar and Java analysis).

## Operational Success

The platform successfully supported major CTF competitions, including ABC Ireland 2012, OWASP Lads online CTF (approximately 600 users), AbstE EU, global CTF, and on-premises competitions in Dublin, Facebook, and Ireland. One instance generated 200 GB of application logs without being compromised.

## Current State and Needs

Security Shepherd currently covers all OWASP Top 10 web application risks and approximately 60% of OWASP mobile risks across roughly 50 levels, progressing from novice to expert difficulty. The project urgently needs community contributions: more bad fix examples, localization/translation support, expansion to iOS and Windows platforms, and improved tooling for custom content integration. The platform is available live at the time of the talk for hands-on exploration.