diff --git a/.github/scripts/docker-create-and-push.sh b/.github/scripts/docker-create-and-push.sh index c767ca8bd..78b91d44e 100755 --- a/.github/scripts/docker-create-and-push.sh +++ b/.github/scripts/docker-create-and-push.sh @@ -16,7 +16,7 @@ echo "tagging version" docker buildx create --name mybuilder docker buildx use mybuilder echo "generating challenge 12-data" -openssl rand -base64 32 > yourkey.txt +openssl rand -base64 32 | tr -d '\n' > yourkey.txt echo "creating containers" docker buildx build --platform linux/amd64,linux/arm64 -t jeroenwillemsen/addo-example:$1-no-vault --build-arg "$3" --build-arg "PORT=8081" --build-arg "argBasedVersion=$1" --build-arg "spring_profile=without-vault" --push ./../../. docker buildx build --platform linux/amd64,linux/arm64 -t jeroenwillemsen/addo-example:$1-local-vault --build-arg "$3" --build-arg "PORT=8081" --build-arg "argBasedVersion=$1" --build-arg "spring_profile=local-vault" --push ./../../. diff --git a/README.md b/README.md index 828fb0c94..46ba3127c 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ Welcome to the OWASP WrongSecrets p0wnable app. With this app, we have packed various ways of how to not store your secrets. These can help you to realize whether your secret management is ok. The challenge is to find all the different secrets by means of various tools and techniques. -Can you solve all the 11 challenges? +Can you solve all the 12 challenges? ![screenshot.png](screenshot.png) ## Support @@ -13,7 +13,7 @@ Need support? Contact us via [OWASP Slack](https://owasp.slack.com/archives/C02K ## Basic docker exercises -_Can be used for challenges 1-4, 8_ +_Can be used for challenges 1-4, 8, 12_ For the basic docker exercises you currently require: @@ -33,7 +33,8 @@ Now you can try to find the secrets by means of solving the challenge offered at - [localhost:8080/challenge/3](http://localhost:8080/challenge/3) - [localhost:8080/challenge/4](http://localhost:8080/challenge/4) - [localhost:8080/challenge/8](http://localhost:8080/challenge/8) - +- [localhost:8080/challenge/8](http://localhost:8080/challenge/12) +- Note that these challenges are still very basic, and so are their explanations. Feel free to file a PR to make them look better ;-). ### Running these on Heroku @@ -50,7 +51,7 @@ You can test them out at Challenge 9 Challenge 10 Challenge 11 + Challenge 12
  • @@ -68,7 +69,7 @@

    value="Reset"/>

    - There are 11 challenges (/challenge/1-11), can you solve them all?
    + There are 12 challenges (/challenge/1-12), can you solve them all?
    Previous diff --git a/src/main/resources/templates/error.html b/src/main/resources/templates/error.html index e5d5c2a71..c7978d3f5 100644 --- a/src/main/resources/templates/error.html +++ b/src/main/resources/templates/error.html @@ -37,6 +37,7 @@ Challenge 9 Challenge 10 Challenge 11 + Challenge 12

  • diff --git a/src/main/resources/templates/index.html b/src/main/resources/templates/index.html index 2c1238753..f10aeb84b 100644 --- a/src/main/resources/templates/index.html +++ b/src/main/resources/templates/index.html @@ -37,6 +37,7 @@ Challenge 9 Challenge 10 Challenge 11 + Challenge 12
  • @@ -84,6 +85,7 @@

    Welcome

    10 (requires AWS or GCP)
    Challenge 11 (requires AWS or GCP)
    + Challenge 12 (requires Docker)

    Don't want to wait for Vault? here is the secret :(.

    diff --git a/src/main/resources/templates/spoil.html b/src/main/resources/templates/spoil.html index a5414b4a1..940a1809f 100644 --- a/src/main/resources/templates/spoil.html +++ b/src/main/resources/templates/spoil.html @@ -8,6 +8,6 @@

    Spoiling secret

    -There are 11 challenges (/challenge/1-11), can you solve them all? +There are 11 challenges (/challenge/1-12), can you solve them all? \ No newline at end of file diff --git a/src/test/java/org/owasp/wrongsecrets/challenges/docker/Challenge12Test.java b/src/test/java/org/owasp/wrongsecrets/challenges/docker/Challenge12Test.java new file mode 100644 index 000000000..f16732a77 --- /dev/null +++ b/src/test/java/org/owasp/wrongsecrets/challenges/docker/Challenge12Test.java @@ -0,0 +1,54 @@ +package org.owasp.wrongsecrets.challenges.docker; + +import org.assertj.core.api.Assertions; +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.extension.ExtendWith; +import org.junit.jupiter.api.io.TempDir; +import org.mockito.Mock; +import org.mockito.junit.jupiter.MockitoExtension; +import org.owasp.wrongsecrets.ScoreCard; +import org.owasp.wrongsecrets.challenges.Spoiler; +import org.owasp.wrongsecrets.challenges.cloud.Challenge9; + +import java.io.File; +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; + +@ExtendWith(MockitoExtension.class) +class Challenge12Test { + + @Mock + private ScoreCard scoreCard; + + @Test + void solveChallenge12WithoutFile(@TempDir Path dir) throws Exception { + var challenge = new Challenge12(scoreCard, dir.toString()); + + Assertions.assertThat(challenge.answerCorrect("secretvalueWitFile")).isFalse(); + Assertions.assertThat(challenge.answerCorrect("if_you_see_this_please_use_docker_instead")).isTrue(); + } + + @Test + void solveChallenge12WithMNTFile(@TempDir Path dir) throws Exception { + var testFile = new File(dir.toFile(), "yourkey.txt"); + var secret = "secretvalueWitFile"; + Files.writeString(testFile.toPath(), secret); + + var challenge = new Challenge12(scoreCard, dir.toString()); + + Assertions.assertThat(challenge.answerCorrect("secretvalueWitFile")).isTrue(); + } + + @Test + void spoilShouldReturnCorrectAnswer(@TempDir Path dir) throws IOException { + var testFile = new File(dir.toFile(), "yourkey.txt"); + var secret = "secretvalueWitFile"; + Files.writeString(testFile.toPath(), secret); + + var challenge = new Challenge12(scoreCard, dir.toString()); + + Assertions.assertThat(challenge.spoiler()).isEqualTo(new Spoiler("secretvalueWitFile")); + } + +} \ No newline at end of file diff --git a/src/test/resources/application.properties b/src/test/resources/application.properties index 539402936..206553f0e 100644 --- a/src/test/resources/application.properties +++ b/src/test/resources/application.properties @@ -1,20 +1,21 @@ spring.cloud.vault.enabled=false aws.paramstore.enabled=false -password = DefaultLoginPasswordDoNotChange! -SPECIAL_K8S_SECRET = if_you_see_this_please_use_k8s -SPECIAL_SPECIAL_K8S_SECRET = if_you_see_this_please_use_k8s -ARG_BASED_PASSWORD= if_you_see_this_please_use_docker_instead -DOCKER_ENV_PASSWORD= if_you_see_this_please_use_docker_instead -vaultpassword = if_you_see_this_please_use_K8S_and_Vault -vaultpassword.password = if_you_see_this_please_use_K8S_and_Vault -default_aws_value = if_you_see_this_please_use_AWS_Setup -default_gcp_value = if_you_see_this_please_use_GCP_Setup +password=DefaultLoginPasswordDoNotChange! +SPECIAL_K8S_SECRET=if_you_see_this_please_use_k8s +SPECIAL_SPECIAL_K8S_SECRET=if_you_see_this_please_use_k8s +ARG_BASED_PASSWORD=if_you_see_this_please_use_docker_instead +DOCKER_ENV_PASSWORD=if_you_see_this_please_use_docker_instead +vaultpassword=if_you_see_this_please_use_K8S_and_Vault +vaultpassword.password=if_you_see_this_please_use_K8S_and_Vault +default_aws_value=if_you_see_this_please_use_AWS_Setup +default_gcp_value=if_you_see_this_please_use_GCP_Setup AWS_REGION=if_you_see_this_please_use_AWS_Setup -AWS_ROLE_ARN= if_you_see_this_please_use_AWS_Setup -AWS_WEB_IDENTITY_TOKEN_FILE= if_you_see_this_please_use_AWS_Setup -GCP_PROJECT_ID= if_you_see_this_please_use_GCP_Setup -secretmountpath = ${java.io.tmpdir} -wrongsecretvalue = wrongsecret +AWS_ROLE_ARN=if_you_see_this_please_use_AWS_Setup +AWS_WEB_IDENTITY_TOKEN_FILE=if_you_see_this_please_use_AWS_Setup +GCP_PROJECT_ID=if_you_see_this_please_use_GCP_Setup +secretmountpath=${java.io.tmpdir} +challengedockermtpath=${java.io.tmpdir} +wrongsecretvalue=wrongsecret APP_VERSION=0.0.0 K8S_ENV=test #---