OWASP WrongSecrets
Share on MastodonOWASP WrongSecrets is the first Secrets Management-focused vulnerable/p0wnable app! It can be used in security trainings, awareness demos, as a test environment for secret detection tools, and bad practice detection tooling.
Description
WrongSecrets is based on Java, Docker, Terraform, and a bit of scripting fun. It contains more than 25 exercises with various wrongly stored or misconfigured secrets - which you need to find. Finding these secrets will
- Help you to look for secrets being misconfigured at your own environment, or target environments for bug bounties.
- Help you to re-evaluate your own secrets management practices as well.
Want to play?
There are multiple ways on how you can play/work with OWASP WrongSecrets. Want to play locally? Try
docker run -p 8080:8080 jeroenwillemsen/wrongsecrets:latest-no-vault
Otherwie try one of the following online environments:
- Online demo (Heroku Free)
- Online CTF demo env (Heroku Free)
- Online demo (Fly Free)
- Online demo (Okteto Free)
Contributors
Leaders:
Top contributors:
- Nanne Baars @nbaars
- Joss Sparkes @remakingeden
- Marcin Nowak @MarcinNowak-codes
- Tibor Hercz @tiborhercz
- Chris Elbring Jr. @neatzsche
- Filip Chyla @fchyla
- Dmitry Litosh @Dlitosh
- Josh Grossman @tghosth
- Spyros @northdpole
- Mike Woudenberg @mikewoudenberg
- Ruben Kruiver @RubenAtBinx
- Nicolas Humblot @nhumblot
- Finn @f3rn0s
- Alex Bender @alex-bender
- Rick M @kingthorin
Testers:
Special mentions for helping out:
- Madhu Akula @madhuakula
- Björn Kimminich @bkimminich
- Xiaolu Dai @saragluna
- Jonathan Giles @jonathanGiles
Actual contributors at this point in time.
Sponsorships
We would like to thank the following parties for helping us out:
GitGuardian for their sponsorship which allows us to pay the bills for our cloud-accounts.
Jetbrains for licensing an instance of Intellij IDEA Ultimate edition to the project leads. We could not have been this fast with the development without it!
Docker for granting us their Docker Open Source Sponsored program.
1Password for granting us an open source license to 1Password for the secret detection testbed.
Licensing
This program is free software: You can redistribute it and/or modify it under the terms of the MIT License. OWASP WrongSecrets and any contributions are Copyright © by Jeroen Willemsen & the OWASP WrongSecrets contributors 2020-2022.
Presentations about OWASP WrongSecrets
The project has been promoted at:
- AllDayDevOps: Our secrets management journey from Code to Vault
- Conf42 DevSecOps 2021: Secrets-management: challenges from code to cloud
- Club Cloud 2021: Securing your secrets in the cloud
- OWASP Dutch Chapter Meetup: Our Secrets Management Journey: From Code to Vault
- Application Security Podcast: Jeroen Willemsen & Ben de Haan – Dirty little secrets
- Open Security Summit: OWASP Wrong Secrets: project goals, under the hood, and where do we go from here?
- WrongSecrets demo - How not to store secrets with the project founder Jeroen Willemsen
- Security Journey: Jeroen Willemsen and Ben de Haan - Dirty little secrets
- Meetup OWASP Bay Area: OWASP WrongSecrets: how to NOT mange your secrets
- Code to Cloud Virtual Summit: Learn How to (Not) Use Secrets with OWASP WrongSecrets!
- Teqnation 2022 Utrecht
- Devops Pro Europe: Introducing OWASP WrongSecrets: How You Should NOT Handle Your Secrets
- OWASP Virtual Appsec Europe 2022: OWASP WrongSecrets: We have a secret for Everyone!
- Tweakers Developers Summit: OWASP WrongSecrets - waar je je applicatiegeheimen (niet) moet neerzetten
- OWASP Frankfurt #55 In-Person Event: Cloud Secrets,Cyber-Crime & Threat Modeling: Can’t you keep a secret? Learn Secrets Management with OWASP WrongSecrets by Dan Gora, OWASP Frankfurt
- OWASP Hamburg Stammtich
- DevSecOps Days 2022 Washington DC (Virtual): Learn How To (Not) Use Secrets With OWASP Wrong Secrets! and see the Youtube recording here
- AllDayDevOps - Learn how to (not) use secrets with OWASP WrongSecrets!
- Azure Cloud Security Group - Can’t You Keep a Secret ? Cloud Native Secrets Management with OWASP Wrong Secrets
- OWASP Benelux Days 2022 - CTF Kickoff with actual CTF info
- A blog by Gitguardian, Blogs by the author
We would like to thank many people that have given a shoutout or a share about this project! Thank you for your forum-posts, blogs, and more!
Overview
The application can best be run as a Docker container as part of a K8s cluster. Some challenges are unique to specific public clouds (AWS, GCP, and Azure only for now).
The overview above nicely shows which technologies are mostly used to build up the full application. Consult the GitHub repo readme for more information.
CTF
We support playing CTFs with OWASP WrongSecrets! Want to know more? Have a look at the Git repo README and the additional CTF documentation
Note that we are working on a larger CTF platform, which you can find at https://github.com/OWASP/wrongsecrets-ctf-party. It has been succesfully used in a few CTFs right now. Feel free to take it for a spin!
Wrongsecrets Desktop
Want to try out the secrets-hunting, but don’t want to install all the recommended tools? Try to use our WrongSecrets desktop.
You can run all the tools and a desktop environment in a container by doing the following:
docker run -p 3000:3000 jeroenwillemsen/wrongsecrets-desktop:latest
and open a browser at http://localhost:3000. Want to know more? Checkout the Readme at the WrongSecrets github repo.