Security
Welcome to the OWASP WrongSecrets game! The game is packed with real life examples of how to not store secrets in your software. Each of these examples is captured in a challenge, which you need to solve using various tools and techniques. Solving these challenges will help you recognize common mistakes & can help you to reflect on your own secrets management strategy.
Can you solve all the 48 challenges?
Try some of them on our Heroku demo environment.
Want to play the other challenges? Read the instructions on how to set them up below.
Need support? Contact us via OWASP Slack for which you sign up here , file a PR, file an issue , or use discussions. Please note that this is an OWASP volunteer based project, so it might take a little while before we respond.
Copyright (c) 2020-2024 Jeroen Willemsen and WrongSecrets contributors.
Can be used for challenges 1-4, 8, 12-32, 34, 35-43
For the basic docker exercises you currently require:
You can install it by doing:
docker run -p 8080:8080 jeroenwillemsen/wrongsecrets:latest-no-vault
Now you can try to find the secrets by means of solving the challenge offered at:
Note that these challenges are still very basic, and so are their explanations. Feel free to file a PR to make them look better ;-).
You can test them out at https://wrongsecrets.herokuapp.com/ as well! The folks at Heroku have given us an awesome open source support package, which allows us to run the app for free there, where it is almost always up. Still, please do not fuzz and/or try to bring it down: you would be spoiling it for others that want to testdrive it. Use this link to use our hosted version of the app. If you want to host it on Heroku yourself (e.g., for running a training), you can do so by clicking this link. Please be aware that this will incur costs for which this project and/or its maintainers cannot be held responsible.
status: experimental
You can test them out at https://wrongsecrets.onrender.com/. Please understand that we run on a free-tier instance, we cannot give any guarantees. Please do not fuzz and/or try to bring it down: you would be spoiling it for others that want to testdrive it. Want to deploy yourself with Render? Click the button below:
status: maintained by alphasec.io
If you want to host WrongSecrets on Railway, you can do so by deploying this one-click template. Railway does not offer an always-free plan anymore, but the free trial is good enough to test-drive this before you decide to upgrade. If you need a step-by-step companion guide, see this blog post.
Can be used for challenges 1-6, 8, 12-43, 48
Make sure you have the following installed:
The K8S setup currently is based on using Minikube for local fun. You can use the commands below from the root of the project:
minikube start
kubectl apply -f k8s/secrets-config.yml
kubectl apply -f k8s/secrets-secret.yml
kubectl apply -f k8s/challenge33.yml
echo "Setting up the bitnami sealed secret controler"
kubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.27.0/controller.yaml
kubectl apply -f k8s/sealed-secret-controller.yaml
kubectl apply -f k8s/main.key
kubectl delete pod -n kube-system -l name=sealed-secrets-controller
kubectl create -f k8s/sealed-challenge48.json
echo "finishing up the sealed secret controler part"
wait 10 #or check whether secret48 is there
kubectl apply -f k8s/secret-challenge-deployment.yml
while [[ $(kubectl get pods -l app=secret-challenge -o 'jsonpath={..status.conditions[?(@.type=="Ready")].status}') != "True" ]]; do echo "waiting for secret-challenge" && sleep 2; done
kubectl expose deployment secret-challenge --type=LoadBalancer --port=8080
minikube service secret-challenge
Alternatively you can do :
./k8s-vault-minikube-start.sh
now you can use the provided IP address and port to further play with the K8s variant (instead of localhost).
Want to run vanilla on your own k8s? Use the commands below:
kubectl apply -f k8s/secrets-config.yml
kubectl apply -f k8s/secrets-secret.yml
echo "Setting up the bitnami sealed secret controler"
kubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.27.0/controller.yaml
kubectl apply -f k8s/sealed-secret-controller.yaml
kubectl apply -f k8s/main.key
kubectl delete pod -n kube-system -l name=sealed-secrets-controller
kubectl create -f k8s/sealed-challenge48.json
echo "finishing up the sealed secret controler part"
wait 10 #or check whether secret48 is there
kubectl apply -f k8s/challenge33.yml
kubectl apply -f k8s/secret-challenge-deployment.yml
while [[ $(kubectl get pods -l app=secret-challenge -o 'jsonpath={..status.conditions[?(@.type=="Ready")].status}') != "True" ]]; do echo "waiting for secret-challenge" && sleep 2; done
kubectl port-forward \
$(kubectl get pod -l app=secret-challenge -o jsonpath="{.items[0].metadata.name}") \
8080:8080
now you can use the provided IP address and port to further play with the K8s variant (instead of localhost).
Can be used for challenges 1-8, 12-48 Make sure you have the following installed:
Run ./k8s-vault-minikube-start.sh
, when the script is done, then the challenges will wait for you at http://localhost:8080 . This will allow you to run challenges 1-8, 12-48.
When you stopped the k8s-vault-minikube-start.sh
script and want to resume the port forward run: k8s-vault-minikube-resume.sh
.
This is because if you run the start script again it will replace the secret in the vault and not update the secret-challenge application with the new secret.
Can be used for challenges 1-48
READ THIS: Given that the exercises below contain IAM privilege escalation exercises, never run this on an account which is related to your production environment or can influence your account-over-arching resources.
Follow the steps in the README in the AWS subfolder.
Follow the steps in the README in the GCP subfolder.
Follow the steps in the README in the Azure subfolder.
When you want to include your own Canarytokens for your cloud-deployment, do the following:
AWS Keys
, in the webHook URL field add <your-domain-created-at-step1>/canaries/tokencallback
.Each challenge has a Show hints
button and a What's wrong?
button. These buttons help to simplify the challenges and give explanation to the reader. Though, the explanations can spoil the fun if you want to do this as a hacking exercise.
Therefore, you can manipulate them by overriding the following settings in your env:
hints_enabled=false
will turn off the Show hints
button.reason_enabled=false
will turn of the What's wrong?
explanation button.spoiling_enabled=false
will turn off the /spoil/challenge-x
endpoint (where x
is the short-name of the challenge).You can enable Swagger documentation and the Swagger UI by overriding the SPRINGDOC_UI
and SPRINGDOC_DOC
when running the Docker container.
Leaders:
Top contributors:
Contributors:
Testers:
Special thanks:
We would like to thank the following parties for helping us out:
GitGuardian for their sponsorship which allows us to pay the bills for our cloud-accounts.
Jetbrains for licensing an instance of Intellij IDEA Ultimate edition to the project leads. We could not have been this fast with the development without it!
1Password for granting us an open source license to 1Password for the secret detection testbed.
AWS for granting us AWS Open Source credits which we use to test our project and the Wrongsecrets CTF Party setup on AWS.
You can help us by the following methods:
As tons of secret detection tools are coming up for both Docker and Git, we are creating a Benchmark testbed for it. Want to know if your tool detects everything? We will keep track of the embedded secrets in this issue and have a branch in which we put additional secrets for your tool to detect. The branch will contain a Docker container generation script using which you can eventually test your container secret scanning.
We have 3 ways of playing CTFs:
Want to use CTFD to play a CTF based on the free Heroku wrongsecrets-ctf instance together with CTFD? You can!
NOTE: CTFD support now works based on the Juiceshop CTF CLI.
NOTE-II: https://wrongsecrets-ctf.herokuapp.com (temporary down based on lack of oss credits) is based on Heroku and has limited capacity.
Initial creation of the zip file for CTFD requires you to visit https://wrongsecrets-ctf.herokuapp.com/api/Challenges once before executing the steps below.
Follow the following steps:
npm install -g juice-shop-ctf-cli@9.1.0
juice-shop-ctf #choose ctfd and https://wrongsecrets-ctf.herokuapp.com as domain. No trailing slash! The key is 'TRwzkRJnHOTckssAeyJbysWgP!Qc2T', feel free to enable hints. We do not support snippets or links/urls to code or hints.
docker run -p 8001:8000 -it ctfd/ctfd:3.4.3
Now visit the CTFD instance at http://localhost:8001 and setup your CTF. Then use the administrative backup function to import the zipfile you created with the juice-shop-ctf command. Game on using https://wrongsecrets-ctf.herokuapp.com! Want to setup your own? You can! Watch out for people finding your key though, so secure it properly: make sure the running container with the actual ctf-key is not exposed to the audience, similar to our heroku container.
NOTE: FBCTF support is experimental.
Follow the same step as with CTFD, only now choose fbctfd and as a url for the countrymapping choose https://raw.githubusercontent.com/OWASP/wrongsecrets/79a982558016c8ce70948a8106f9a2ee5b5b9eea/config/fbctf.yml
.
Then follow https://github.com/facebookarchive/fbctf/wiki/Quick-Setup-Guide to run the FBCTF.
For development on local machine use the local
profile ./mvnw spring-boot:run -Dspring-boot.run.profiles=local,without-vault
If you want to test against vault without K8s: start vault locally with
export SPRING_CLOUD_VAULT_URI='http://127.0.0.1:8200'
export VAULT_API_ADDR='http://127.0.0.1:8200'
vault server -dev
and in your next terminal, do (with the token from the previous commands):
export SPRING_CLOUD_VAULT_URI='http://127.0.0.1:8200'
export SPRING_CLOUD_VAULT_TOKEN='<TOKENHERE>'
vault token create -id="00000000-0000-0000-0000-000000000000" -policy="root"
vault kv put secret/secret-challenge vaultpassword.password="$(openssl rand -base64 16)"
vault kv put secret/injected vaultinjected.value="$(openssl rand -base64 16)"
vault kv put secret/codified challenge47secret.value="debugvalue"
Now use the local-vault
profile to do your development.
./mvnw spring-boot:run -Dspring-boot.run.profiles=local,local-vault
If you want to dev without a Vault instance, use additionally the without-vault
profile to do your development:
./mvnw spring-boot:run -Dspring-boot.run.profiles=local,without-vault
Want to push a container? See .github/scripts/docker-create-and-push.sh
for a script that generates and pushes all containers. Do not forget to rebuild the app before composing the container.
Want to check why something in vault is not working in kubernetes? Do kubectl exec vault-0 -n vault -- vault audit enable file file_path=stdout
.
We have CycloneDX and OWASP Dependency-check integrated to check dependencies for vulnerabilities.
You can use the OWASP Dependency-checker by calling mvn dependency-check:aggregate
and mvn cyclonedx:makeBom
to use CycloneDX to create an SBOM.
Requirements: make sure you have the following tools installed: Docker, Java22 JDK, NodeJS 20 and IntelliJ IDEA.
main
method in org.owasp.wrongsecrets.WrongSecretsApplication.java
. This should fail with a stack trace.without-vault
. This is done by setting the VM options arguments to --server.port=8080 --spring.profiles.active=local,without-vault
. Set K8S_ENV=docker
as environment argument.Pictorial Guide on how to get the project started in IntelliJ IDEA is available at Contributing.md.
Feel free to edit and propose changes via pull requests. Be sure to follow our guidance in the documentation to get your work accepted.
Please note that we officially only support Linux and MacOS for development. If you want to develop using a Windows machine, use WSL2 or a virtual machine running Linux. We did include Windows detection & a bunch of exe
files for a first experiment, but are looking for active maintainers of them. Want to make sure it runs on Windows? Create PRs ;-).
If, after reading this section, you still have no clue on the application code: Have a look at some tutorials on Spring boot from Baeldung.
To make changes made load faster we added spring-dev-tools
to the Maven project.
To enable this in IntelliJ automatically, make sure:
You can also manually invoke: Build -> Recompile the file you just changed, this will also force reloading of the application.
Follow the steps below on adding a challenge:
org.owasp.wrongsecrets.challenges
folder. Make sure you add an explanation in src/main/resources/explanations
and refer to it from your new Challenge class.src/main/resources/wrong-secrets-configuration.yaml
For more details please refer Contributing.md.
If you want to move existing cloud challenges to another cloud: extend Challenge classes in the org.owasp.wrongsecrets.challenges.cloud
package and make sure you add the required Terraform in a folder with the separate cloud identified. Make sure that the environment is added to org.owasp.wrongsecrets.RuntimeEnvironment
.
Collaborate with the others at the project to get your container running so you can test at the cloud account.
If you have made some changes to the codebase or added a new challenge and would like to see exactly how the container will look after merge for testing, we have a script that makes this very easy. Follow the steps below:
bash docker-create.sh
.
eval $(minikube docker-env)
.docker run -p 8080:8080 jeroenwillemsen/wrongsecrets:local-test-no-vault
jeroenwillemsen/wrongsecrets:local-test-k8s-vault
in your deployment definition.jeroenwillemsen/wrongsecrets:local-test-local-vault
in your deployment definition.We currently have 2 different test-suites, both fired with ./mvnw test
.
test/java
folder with output stored at the default target directory.test/e2e
folder with output stored at target/test-classes/e2e/cypress/reports/
. See the cypress readme for more details.Note: You can do a full roundtrip of cleaning, building, and testing with ./mvnw clean install
.
If you want to play the challenges, but cannot install tools like keepass, Radare, etc. But are allowed to run Docker containers, try the following:
docker run -p 3000:3000 -v /var/run/docker.sock:/var/run/docker.sock jeroenwillemsen/wrongsecrets-desktop:latest
or use something more configurable:
docker run -d \
--name=webtop \
--security-opt seccomp=unconfined \
-e PUID=1000 \
-e PGID=1000 \
-e TZ=Europe/London \
-e SUBFOLDER=/ \
-e KEYBOARD=en-us-qwerty \
-p 3000:3000 \
-v /var/run/docker.sock:/var/run/docker.sock \
--shm-size="2gb" \
--restart unless-stopped \
jeroenwillemsen/wrongsecrets-desktop:latest
And then at http://localhost:3000.
Note: be careful with trying to deploy the jeroenwillemsen/wrongsecrets-desktop
container to Heroku ;-).
NOTE: We do not officially support Colima, as we can tell that Github runners have loads of issues with it.
If you cannot switch to Docker Desktop/Podman and you want to use Colima with Apple Silicon M1
to run Docker image jeroenwillemsen/wrongsecrets
you try one of:
colima stop
)docker --context desktop-linux run -p 8080:8080 jeroenwillemsen/wrongsecrets:latest-no-vault
)colima start -m 8 -c 1 --arch x86_64
)If you want to run WrongSecrets but without certain challenges you don't want to present to others: please read this section.
NOTE Please note that we do not deliver any support to your fork when you follow the process below. Please understand that license and copyright of the original application remain intact for your Fork.
Requirements:
Here are the steps you have to follow to create your own release of WrongSecrets with certain challenges disabled:
src/main/resources/wrong-secrets-configuration.yaml
remove the reference to the challenge you no longer want to have in your fork../mvnw clean install
docker buildx create --name mybuilder
docker buildx use mybuilder
docker buildx build --platform linux/amd64,linux/arm64 -t <registry/container-name>:<yourtag>-no-vault --build-arg "argBasedPassword='this is on your command line'" --build-arg "PORT=8081" --build-arg "argBasedVersion=<yourtag>" --build-arg "spring_profile=without-vault" --push
docker buildx build --platform linux/amd64,linux/arm64 -t <registry/container-name>:<yourtag>-kubernetes-vault--build-arg "argBasedPassword='this is on your command line'" --build-arg "PORT=8081" --build-arg "argBasedVersion=<yourtag>" --build-arg "spring_profile=kubernetes-vault" --push
Want to learn more? Checkout the sources below: