OWASP WrongSecrets

Welcome to the OWASP WrongSecrets p0wnable app. With this app, we have packed various ways of how to not store your secrets. These can help you to realize whether your secret management is ok. The challenge is to find all the different secrets by means of various tools and techniques.

Can you solve all the 27 challenges?

Support

Need support? Contact us via OWASP Slack for which you sign up here , file a PR, file an issue , or use discussions. Please note that this is an OWASP volunteer based project, so it might take a little while before we respond.

Basic docker exercises

Can be used for challenges 1-4, 8, 12-27

For the basic docker exercises you currently require:

Docker Install from here
Some Browser that can render HTML

You can install it by doing:

docker run -p 8080:8080 jeroenwillemsen/wrongsecrets:latest-no-vault

Now you can try to find the secrets by means of solving the challenge offered at:

Note that these challenges are still very basic, and so are their explanations. Feel free to file a PR to make them look better ;-).

Running these on Heroku

You can test them out at https://wrongsecrets.herokuapp.com/ as well! But please understand that we have NO guarantees that this works. Given we run in Heroku free-tier, please do not fuzz and/or try to bring it down: you would be spoiling it for others that want to testdrive it.

Deploying the app under your own heroku account

Sign up to Heroku and log in to your account
Click the button below and follow the instructions

Running on Fly.io

You can test them out at https://wrongsecrets.fly.dev as well! Please understand that we run on a free-tier instance, we cannot give any guarantees. Please do not fuzz and/or try to bring it down: you would be spoiling it for others that want to testdrive it.

Basic K8s exercise

Can be used for challenges 1-6, 8, 12-27

Minikube based

Make sure you have the following installed:

Docker Install from here
Minikube Install from here

The K8S setup currently is based on using Minikube for local fun:

    minikube start
    kubectl apply -f k8s/secrets-config.yml
    kubectl apply -f k8s/secrets-secret.yml
    kubectl apply -f k8s/secret-challenge-deployment.yml
    while [[ $(kubectl get pods -l app=secret-challenge -o 'jsonpath={..status.conditions[?(@.type=="Ready")].status}') != "True" ]]; do echo "waiting for secret-challenge" && sleep 2; done
    kubectl expose deployment secret-challenge --type=LoadBalancer --port=8080
    minikube service secret-challenge

now you can use the provided IP address and port to further play with the K8s variant (instead of localhost).

k8s based

Want to run vanilla on your own k8s? Use the commands below:

    kubectl apply -f k8s/secrets-config.yml
    kubectl apply -f k8s/secrets-secret.yml
    kubectl apply -f k8s/secret-challenge-deployment.yml
    while [[ $(kubectl get pods -l app=secret-challenge -o 'jsonpath={..status.conditions[?(@.type=="Ready")].status}') != "True" ]]; do echo "waiting for secret-challenge" && sleep 2; done
    kubectl port-forward \
        $(kubectl get pod -l app=secret-challenge -o jsonpath="{.items[0].metadata.name}") \
        8080:8080

now you can use the provided IP address and port to further play with the K8s variant (instead of localhost).

Okteto based

Don't want to go over the hassle of setting up K8S yourself? visit https://wrongsecrets-commjoen.cloud.okteto.net. Please note that we are using the free Developer version here, so it might take a while for it to respond at first (e.g. "development environment not ready" and then a 50x for a minute). Please: do not try to hack/Fuzz the application as this might bring it down and spoil the fun for others.

Vault exercises with minikube

Can be used for challenges 1-8, 12-27 Make sure you have the following installed:

minikube with docker (or comment out line 8 and work at your own k8s setup),
docker,
helm Install from here,
kubectl Install from here,
jq Install from here,
vault Install from here,
grep, Cat, and Sed

Run ./k8s-vault-minkube-start.sh, when the script is done, then the challenges will wait for you at http://localhost:8080 . This will allow you to run challenges 1-8, 12-22.

When you stopped the k8s-vault-minikube-start.sh script and want to resume the port forward run: k8s-vault-minikube-resume.sh. This is because if you run the start script again it will replace the secret in the vault and not update the secret-challenge application with the new secret.

Cloud Challenges

Can be used for challenges 1-27

READ THIS: Given that the exercises below contain IAM privilege escalation exercises, never run this on an account which is related to your production environment or can influence your account-over-arching resources.

Running Challenge15 in your own cloud only

When you want to include your own Canarytokens for your cloud-deployment, do the following:

Fork the project.
Make sure you use the GCP ingress or AWS ingress scripts to generate an ingress for your project.
Go to canarytokens.org and select AWS Keys, in the webHook URL field add <your-domain-created-at-step1>/canaries/tokencallback.
Encrypt the received credentials so that Challenge15 can decrypt them again.
Commit the unencrypted and encrypted materials to Git and then commit again without the decrypted materials.
Adapt the hints of Challenge 15 in your fork to point to your fork.
Create a container and push it to your registry
Override the K8s definition files for either AWS or GCP.

Do you want to play without guidance?

Each challenge has a Show hints button and a What's wrong? button. These buttons help to simplify the challenges and give explanation to the reader. Though, the explanations can spoil the fun if you want to do this as a hacking exercise. Therefore, you can manipulate them by overriding the following settings in your env:

hints_enabled=false will turn off the Show hints button.
reason_enabled=false will turn of the What's wrong? explanation button.

Special thanks & Contributors

Leaders:

Top contributors:

Testers:

Special mentions for helping out:

Sponsorships

We would like to thank the following parties for helping us out:

GitGuardian for their sponsorship which allows us to pay the bills for our cloud-accounts.

Jetbrains for licensing an instance of Intellij IDEA Ultimate edition to the project leads. We could not have been this fast with the development without it!

Docker for granting us their Docker Open Source Sponsored program.

1Password for granting us an open source license to 1Password for the secret detection testbed.

Help Wanted

You can help us by the following methods:

Star us
Share this app with others
Of course, we can always use your help to get more flavors of "wrongly" configured secrets in to spread awareness! We would love to get some help with other cloudproiders, like Alibabaor Tencent cloud for instance. Do you miss something else than a cloud provider as an example? File an issue or create a PR! See our guide on contributing for more details. Contributors will be listed in releases, in the "Special thanks & Contributors"-section, and the web-app.

Use OWASP WrongSecrets as a secret detection benchmark

As tons of secret detection tools are coming up for both Docker and Git, we are creating a Benchmark testbed for it. Want to know if your tool detects everything? We will keep track of the embedded secrets in this issue and have a branch in which we put additional secrets for your tool to detect. The branch will contain a Docker container generation script using which you can eventually test your container secret scanning.

CTF

We have 3 ways of playing CTFs:

The quick "let's play"-approach based on our own Heroku domain https://wrongsecrets-ctf.herokuapp.com, which we documente for you here.
A more extended approach documented in ctf-instructions.md.
A fully customizable CTF setup where every player gets its own virtual instance of WrongSecrets and a virtual instance of the wrongsecrets-desktop, so they all can play hassle-free. For this you have to use the WrongSecrets CTF Party setup.

CTFD Support

Want to use CTFD to play a CTF based on the free Heroku wrongsecrets-ctf instance together with CTFD? You can!

NOTE: CTFD support now works based on the Juiceshop CTF CLI. NOTE-II: https://wrongsecrets-ctf.herokuapp.com is based on a free heroku instance, which takes time to warm up. Initial creation of the zip file for CTFD requires you to visit https://wrongsecrets-ctf.herokuapp.com/api/Challenges once before executing the steps below.

Follow the following steps:

    npm install -g juice-shop-ctf-cli@9.1.0
    juice-shop-ctf #choose ctfd and https://wrongsecrets-ctf.herokuapp.com as domain. No trailing slash! The key is 'TRwzkRJnHOTckssAeyJbysWgP!Qc2T', feel free to enable hints. We do not support snippets or links/urls to code or hints.
    docker run -p 8001:8000 -it ctfd/ctfd:3.4.3

Now visit the CTFD instance at http://localhost:8001 and setup your CTF. Then use the administrative backup function to import the zipfile you created with the juice-shop-ctf command. Game on using https://wrongsecrets-ctf.herokuapp.com! Want to setup your own? You can! Watch out for people finding your key though, so secure it properly: make sure the running container with the actual ctf-key is not exposed to the audience, similar to our heroku container.

FBCTF Support (Experimental!)

NOTE: FBCTF support is experimental.

Follow the same step as with CTFD, only now choose fbctfd and as a url for the countrymapping choose https://raw.githubusercontent.com/OWASP/wrongsecrets/79a982558016c8ce70948a8106f9a2ee5b5b9eea/config/fbctf.yml. Then follow https://github.com/facebookarchive/fbctf/wiki/Quick-Setup-Guide to run the FBCTF.

Notes on development

For development on local machine use the local profile ./mvnw spring-boot:run -Dspring-boot.run.profiles=local

If you want to test against vault without K8s: start vault locally with

 export VAULT_ADDR='http://127.0.0.1:8200'
 export VAULT_API_ADDR='http://127.0.0.1:8200'
 vault server -dev

and in your next terminal, do (with the token from the previous commands):

export VAULT_ADDR='http://127.0.0.1:8200'
export VAULT_TOKEN='<TOKENHERE>'
vault token create -id="00000000-0000-0000-0000-000000000000" -policy="root"
vault kv put secret/secret-challenge vaultpassword.password="$(openssl rand -base64 16)"

Now use the local-vault profile to do your development.

./mvnw spring-boot:run -Dspring-boot.run.profiles=local,local-vault

If you want to dev without a Vault instance, use additionally the without-vault profile to do your development:

./mvnw spring-boot:run -Dspring-boot.run.profiles=local,without-vault

Want to push a container? See .github/scripts/docker-create-and-push.sh for a script that generates and pushes all containers. Do not forget to rebuild the app before composing the container

Dependency management

We have CycloneDX and OWASP Dependency-check integrated to check dependencies for vulnerabilities. You can use the OWASP Dependency-checker by calling mvn dependency-check:aggregate and mvn cyclonedx:makeBom to use CycloneDX to create an SBOM.

Automatic reload during development

To make changes made load faster we added spring-dev-tools to the Maven project. To enable this in IntelliJ automatically, make sure:

Under Compiler -> Automatically build project is enabled, and
Under Advanced settings -> Allow auto-make to start even if developed application is currently running.

You can also manually invoke: Build -> Recompile the file you just changed, this will also force reloading of the application.

How to add a Challenge

Follow the steps below on adding a challenge:

First make sure that you have an Issue reported for which a challenge is really wanted.
Add the new challenge in the org.owasp.wrongsecrets.challenges folder. Make sure you add an explanation in src/main/resources/explanations and refer to it from your new Challenge class.
Add a unit and integration test to show that your challenge is working.
Don't forget to add @Order annotation to your challenge ;-).

If you want to move existing cloud challenges to another cloud: extend Challenge classes in the org.owasp.wrongsecrets.challenges.cloud package and make sure you add the required Terraform in a folder with the separate cloud identified. Make sure that the environment is added to org.owasp.wrongsecrets.RuntimeEnvironment. Collaborate with the others at the project to get your container running so you can test at the cloud account.

Local testing

If you have made some changes to the codebase or added a new challenge and would like to see exactly how the container will look after merge for testing, we have a script that makes this very easy. Follow the steps below:

Ensure you have bash installed and open.
Navigate to .github/scripts.
Run the docker-create script bash docker-create.sh.
Follow any instructions given, you made need to install/change packages.
Run the newly created container docker run -p 8080:8080 jeroenwillemsen/wrongsecrets:local-test

Want to play, but are not allowed to install the tools?

If you want to play the challenges, but cannot install tools like keepass, Radare, etc. But are allowed to run Docker containers, try the following:

docker run -p 3000:3000 -v /var/run/docker.sock:/var/run/docker.sock jeroenwillemsen/wrongsecrets-desktop:latest

or use something more configurable:

docker run -d \
  --name=webtop \
  --security-opt seccomp=unconfined \
  -e PUID=1000 \
  -e PGID=1000 \
  -e TZ=Europe/London \
  -e SUBFOLDER=/ \
  -e KEYBOARD=en-us-qwerty \
  -p 3000:3000 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  --shm-size="2gb" \
  --restart unless-stopped \
  jeroenwillemsen/wrongsecrets-desktop:latest

And then at http://localhost:3000.

Note: be careful with trying to deploy the jeroenwillemsen/wrongsecrets-desktop container to Heroku ;-).

nhumblot/wrongsecrets