OWASP WrongSecrets

OWASP WrongSecrets is the first Secrets Management-focused vulnerable/p0wnable app! It can be used as a stand-alone game, as part of security trainings, awareness demos, as a test environment for secret detection tools, and bad practice detection tooling. It even has a supporting CTF platform to play the game in a larger group.

Want to give it a shot? Go to our demo environment running on Heroku.

WrongSecrets is based on Java, Docker, Terraform, and a bit of scripting fun. It contains more than 50 exercises with various wrongly stored or misconfigured secrets - which you need to find. Finding these secrets will

• Help you to look for secrets being misconfigured at your own environment, or target environments for bug bounties.

• Help you to re-evaluate your own secrets management practices as well.

You can help us in many ways:

• Star us on github: OWASP/WrongSecrets

• Promote us using Twitter/Mastodon.

• Promote us with a Blog, Vlog, Podcast, or presentation on a conference. Or use our materials to organize a CTF! If you do, let us know, so we can list your event or publication here on the webiste.

• Work with us on the project! Take a look at the Readme of the project, How to contribute, and the Github Issues. If you want to contribute to an issue: make sure it is not yet assigned to someone, comment on it with your intention, and then we can assign it to you.

• Sponsor our project! We will use the money for covering our cloud costs (building & maintaining the project in 3 clouds costs money). And soon we hope to be able to buy you some stickers if you do ;-).

The project has been promoted at:

• AllDayDevOps: Our secrets management journey from Code to Vault

• Conf42 DevSecOps 2021: Secrets-management: challenges from code to cloud

• Club Cloud 2021: Securing your secrets in the cloud

• OWASP Dutch Chapter Meetup: Our Secrets Management Journey: From Code to Vault

• Open Security Summit: OWASP Wrong Secrets: project goals, under the hood, and where do we go from here?

• WrongSecrets demo - How not to store secrets with the project founder Jeroen Willemsen

• Security Journey: Jeroen Willemsen and Ben de Haan - Dirty little secrets

• Meetup OWASP Bay Area: OWASP WrongSecrets: how to NOT mange your secrets

• Code to Cloud Virtual Summit: Learn How to (Not) Use Secrets with OWASP WrongSecrets!

• Teqnation 2022 Utrecht

• Devops Pro Europe: Introducing OWASP WrongSecrets: How You Should NOT Handle Your Secrets

• OWASP Virtual Appsec Europe 2022: OWASP WrongSecrets: We have a secret for Everyone!

• Tweakers Developers Summit: OWASP WrongSecrets - waar je je applicatiegeheimen (niet) moet neerzetten

• OWASP Frankfurt #55 In-Person Event: Cloud Secrets,Cyber-Crime & Threat Modeling: Can’t you keep a secret? Learn Secrets Management with OWASP WrongSecrets by Dan Gora, OWASP Frankfurt

• OWASP Hamburg Stammtich

• DevSecOps Days 2022 Washington DC (Virtual): Learn How To (Not) Use Secrets With OWASP Wrong Secrets! and see the Youtube recording here

• AllDayDevOps - Learn how to (not) use secrets with OWASP WrongSecrets!

• Azure Cloud Security Group - Can’t You Keep a Secret ? Cloud Native Secrets Management with OWASP Wrong Secrets

• Azure Cloud Security Meetup: Cloud-Native Secrets Management with OWASP WrongSecrets by Dan Gora

• OWASP Benelux Days 2022 - CTF Kickoff with actual CTF info

• WeHackPurple: Don’t make the same mistakes we did: How you can do secrets management better with OWASP WrongSecrets

• Open Security Summit: OWASP WrongSecrets a journey into secrets management

• Open Security Summit: OWASP WrongSecrets: Define the future challenges togeter

• Cyberwisecon: OWASP WrongSecrets: How We Keep on Growing Our Open Source Project

• NLUUG: How to (not) Use Secrets with OWASP WrongSecrets recording from From 2:13

• ADDO: OWASP WrongSecrets: How We Keep on Growing Our Open Source Project

• OWASP Spotlight Series WrongSecrets

• Coverage on youtube: walkthrough by sec right

• Various Blogs: A blog by Gitguardian, Another blog by Gitguardian, Blogs by the author(s), A blog by Okteto, A blog by Nec, A blog from vineeth.dj.

• Various Podcasts: Application Security Podcast: Jeroen Willemsen & Ben de Haan – Dirty little secrets, Devsec for scale: Secrets Management Pt 1, Devsec for scale: Secrets Management Pt 2, Devsec for scale: Secrets Management Pt 3.

We would like to thank many people that have given a shoutout or a share about this project! Thank you for your forum-posts, blogs, and more!