diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile new file mode 100644 index 0000000000..17f1c752be --- /dev/null +++ b/.devcontainer/Dockerfile @@ -0,0 +1,100 @@ +FROM eclipse-temurin:26-jdk-resolute + +LABEL org.opencontainers.image.title="WrongSecrets Dev Container" +LABEL org.opencontainers.image.description="Development environment for OWASP WrongSecrets" +LABEL org.opencontainers.image.source="https://github.com/OWASP/wrongsecrets" + +SHELL ["/bin/bash", "-o", "pipefail", "-c"] + +ENV DEBIAN_FRONTEND=noninteractive + +# --------------------------------------------------------------------------- +# Base development tooling +# --------------------------------------------------------------------------- + +RUN apt-get update \ + && apt-get install -y --no-install-recommends \ + ca-certificates \ + curl \ + git \ + gnupg \ + jq \ + make \ + openssh-client \ + python3 \ + python3-pip \ + unzip \ + wget \ + zip \ + && rm -rf /var/lib/apt/lists/* + +# --------------------------------------------------------------------------- +# Node.js +# --------------------------------------------------------------------------- + +RUN curl -fsSL https://deb.nodesource.com/setup_26.x | bash - \ + && apt-get update \ + && apt-get install -y --no-install-recommends nodejs \ + && node --version \ + && npm --version \ + && rm -rf /var/lib/apt/lists/* + +# --------------------------------------------------------------------------- +# Go +# --------------------------------------------------------------------------- + +ARG GO_VERSION=1.27.1 + +RUN curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-$(dpkg --print-architecture).tar.gz" \ + -o /tmp/go.tar.gz \ + && rm -rf /usr/local/go \ + && tar -C /usr/local -xzf /tmp/go.tar.gz \ + && rm /tmp/go.tar.gz + +ENV GOPATH="/go" +ENV PATH="/usr/local/go/bin:/go/bin:${PATH}" + +RUN mkdir -p /go \ + && go version \ + && go env GOPATH +RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.2 +RUN go install github.com/securego/gosec/v2/cmd/gosec@latest + +# --------------------------------------------------------------------------- +# Terraform +# --------------------------------------------------------------------------- + +RUN install -m 0755 -d /etc/apt/keyrings \ + && curl -fsSL https://apt.releases.hashicorp.com/gpg \ + | gpg --dearmor -o /etc/apt/keyrings/hashicorp-archive-keyring.gpg \ + && chmod a+r /etc/apt/keyrings/hashicorp-archive-keyring.gpg \ + && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(. /etc/os-release && echo "$VERSION_CODENAME") main" \ + > /etc/apt/sources.list.d/hashicorp.list \ + && apt-get update \ + && apt-get install -y --no-install-recommends terraform \ + && terraform version \ + && rm -rf /var/lib/apt/lists/* + +# --------------------------------------------------------------------------- +# Docker CLI + Compose +# --------------------------------------------------------------------------- + +RUN install -m 0755 -d /etc/apt/keyrings \ + && curl -fsSL https://download.docker.com/linux/ubuntu/gpg \ + | gpg --dearmor -o /etc/apt/keyrings/docker.gpg \ + && chmod a+r /etc/apt/keyrings/docker.gpg \ + && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \ + > /etc/apt/sources.list.d/docker.list \ + && apt-get update \ + && apt-get install -y --no-install-recommends \ + docker-ce-cli \ + docker-compose-plugin \ + && docker --version \ + && docker compose version \ + && rm -rf /var/lib/apt/lists/* + +# --------------------------------------------------------------------------- +# Workspace +# --------------------------------------------------------------------------- + +WORKDIR /workspace diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index a3a6afa394..89af2419c5 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -1,37 +1,32 @@ { - "name": "OWASP WrongSecrets (Java 26 & Node.js 26 Dev Container)", - "image": "eclipse-temurin:26-jdk-resolute", //resolute + "name": "WrongSecrets", + + "image": "ghcr.io/owasp/wrongsecrets-devcontainer:26-resolute", + + "workspaceFolder": "/workspace", + "features": { - "ghcr.io/devcontainers/features/node:2": { - "version": "26", - "npmVersion": "11.19.0" - }, - "ghcr.io/devcontainers/features/python:1": { - "version": "3.12" - }, - "ghcr.io/devcontainers/features/terraform:1.5.0": { - "version": "latest", - "tflint": "latest" + "ghcr.io/devcontainers/features/common-utils:2": { + "installZsh": true, + "configureZshAsDefaultShell": true }, - "ghcr.io/devcontainers-extra/features/terraform-docs:1": {}, + "ghcr.io/devcontainers/features/docker-in-docker:4.1.0": { "enableOnStartup": true, "version": "latest", - "moby": false - }, - "ghcr.io/devcontainers/features/go:1": { - "version": "1.22" - }, - "ghcr.io/devcontainers/features/git:1": {}, - "ghcr.io/devcontainers/features/common-utils:2": { - "installZsh": true, - "configureZshAsDefaultShell": true + "moby": false } }, + "containerEnv": { "DEVCONTAINER_SECRET": "WSECR-devcontainer-token-774921" }, - "forwardPorts": [8080, 8090], + + "forwardPorts": [ + 8080, + 8090 + ], + "portsAttributes": { "8080": { "label": "WrongSecrets Web UI", @@ -42,6 +37,7 @@ "onAutoForward": "silent" } }, + "customizations": { "vscode": { "extensions": [ @@ -67,6 +63,6 @@ } } }, - "postCreateCommand": "chmod +x ./mvnw && ./mvnw dependency:resolve -DskipTests && npm install && pip install pre-commit && pre-commit install && pre-commit install --hook-type commit-msg", - "remoteUser": "root" + + "postCreateCommand": ".devcontainer/post-create.sh" } diff --git a/.devcontainer/post-create.sh b/.devcontainer/post-create.sh new file mode 100644 index 0000000000..7c577c1ac0 --- /dev/null +++ b/.devcontainer/post-create.sh @@ -0,0 +1,11 @@ +#!/usr/bin/env bash +set -e + +chmod +x ./mvnw + +./mvnw dependency:resolve -DskipTests + +npm install + +pre-commit install +pre-commit install --hook-type commit-msg diff --git a/.github/workflows/build-devcontainer.yml b/.github/workflows/build-devcontainer.yml new file mode 100644 index 0000000000..b00b0978a5 --- /dev/null +++ b/.github/workflows/build-devcontainer.yml @@ -0,0 +1,72 @@ +name: Build Dev Container + +on: + push: + branches: + - master + paths: + - ".devcontainer/Dockerfile" + - ".devcontainer/devcontainer.json" + - ".github/workflows/build-devcontainer.yml" + + pull_request: + paths: + - ".devcontainer/Dockerfile" + - ".devcontainer/devcontainer.json" + - ".github/workflows/build-devcontainer.yml" + + workflow_dispatch: + +permissions: + contents: read + packages: write + +jobs: + build: + name: Build dev container + runs-on: ubuntu-latest + + steps: + - name: Checkout + uses: actions/checkout@v5 + + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Log in to GHCR + if: github.event_name != 'pull_request' + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Docker metadata + id: meta + uses: docker/metadata-action@v5 + with: + images: ghcr.io/owasp/wrongsecrets-devcontainer + tags: | + type=raw,value=26-resolute + type=sha + + - name: Build and push + uses: docker/build-push-action@v6 + with: + context: . + file: .devcontainer/Dockerfile + + platforms: | + linux/amd64 + linux/arm64 + + push: ${{ github.event_name != 'pull_request' }} + + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + + cache-from: type=gha + cache-to: type=gha,mode=max diff --git a/.github/workflows/sort-contributors-go.yml b/.github/workflows/sort-contributors-go.yml index 365e11ef13..f09cd97e15 100644 --- a/.github/workflows/sort-contributors-go.yml +++ b/.github/workflows/sort-contributors-go.yml @@ -30,8 +30,9 @@ jobs: uses: actions/checkout@v5 - name: Setup Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v7 with: + go-version: '1.27.1' go-version-file: scripts/sort_contibutors/go.mod cache-dependency-path: scripts/sort_contibutors/go.mod @@ -46,11 +47,14 @@ jobs: - name: Install golangci-lint run: | - go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest + go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.2 echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH" - name: Lint run: make lint - name: Security - run: make security + run: | + go install github.com/securego/gosec/v2/cmd/gosec@latest + echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH" + make security diff --git a/Dockerfile b/Dockerfile index 0bd330ec59..d0fc8cdfec 100644 --- a/Dockerfile +++ b/Dockerfile @@ -9,6 +9,9 @@ RUN java -Djarmode=tools -jar application.jar extract --layers --destination ext FROM eclipse-temurin:26-jre-alpine WORKDIR /application +LABEL org.opencontainers.image.title="OWASP WrongSecrets" +LABEL org.opencontainers.image.source="https://github.com/OWASP/wrongsecrets" + ARG argBasedPassword="default" ARG spring_profile="" ARG challenge59_webhook_url="YUhSMGNITTZMeTlvYjI5cmN5NXpiR0ZqYXk1amIyMHZjMlZ5ZG1salpYTXZWREEwVkRRd1RraFlMMEl3T1VSQlRrb3lUamRMTDJNeWFqYzFSVEUzVjFrd2NFeE5SRXRvU0RsbGQzZzBhdz09" diff --git a/README.md b/README.md index 5b3a7987dc..7f4fcdd574 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ [![Tweet](https://img.shields.io/badge/-Twitter-%232B90D9?style=for-the-badge&logo=x&logoColor=white)](https://twitter.com/intent/tweet?text=Want%20to%20dive%20into%20secrets%20management%20and%20do%20some%20hunting?%20try%20this&url=https://github.com/OWASP/wrongsecrets&hashtags=secretsmanagement,secrets,hunting,p0wnableapp,OWASP,WrongSecrets) [](https://tootpick.org/#text=Want%20to%20dive%20into%20secrets%20management%20and%20do%20some%20hunting?%20try%20this%0A%0Ahttps://github.com/OWASP/wrongsecrets%20%23secretsmanagement,%20%23secrets,%20%23hunting,%20%23p0wnableapp,%20%23OWASP,%20%23WrongSecrets) [](https://bsky.app/intent/compose?text=Want%20to%20dive%20into%20secrets%20management%20and%20do%20some%20hunting?%20try%20this%0A%0Ahttps://github.com/OWASP/wrongsecrets%20%23secretsmanagement%20%23secrets%20%23hunting%20%23p0wnableapp%20%23OWASP%20%23WrongSecrets) [](https://www.linkedin.com/shareArticle/?url=https://www.github.com/OWASP/wrongsecrets&title=OWASP%20WrongSecrets) -[![Java checkstyle and testing](https://github.com/OWASP/wrongsecrets/actions/workflows/main.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/main.yml) [![Pre-commit](https://github.com/OWASP/wrongsecrets/actions/workflows/pre-commit.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/pre-commit.yml) [![Terraform FMT](https://github.com/OWASP/wrongsecrets/actions/workflows/terraform.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/terraform.yml) [![CodeQL](https://github.com/OWASP/wrongsecrets/actions/workflows/codeql-analysis.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/codeql-analysis.yml) [![Dead Link Checker](https://github.com/OWASP/wrongsecrets/actions/workflows/link_checker.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/link_checker.yml) [![Javadoc and Swaggerdoc generator](https://github.com/OWASP/wrongsecrets/actions/workflows/java_swagger_doc.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/java_swagger_doc.yml) [![Test Heroku with cypress](https://github.com/OWASP/wrongsecrets/actions/workflows/heroku_tests.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/heroku_tests.yml) +[![Java checkstyle and testing](https://github.com/OWASP/wrongsecrets/actions/workflows/main.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/main.yml) [![Pre-commit](https://github.com/OWASP/wrongsecrets/actions/workflows/pre-commit.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/pre-commit.yml) [![Terraform FMT](https://github.com/OWASP/wrongsecrets/actions/workflows/terraform.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/terraform.yml) [![CodeQL](https://github.com/OWASP/wrongsecrets/actions/workflows/codeql-analysis.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/codeql-analysis.yml) [![Dead Link Checker](https://github.com/OWASP/wrongsecrets/actions/workflows/link_checker.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/link_checker.yml) [![Javadoc and Swaggerdoc generator](https://github.com/OWASP/wrongsecrets/actions/workflows/java_swagger_doc.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/java_swagger_doc.yml) [![Test Heroku with cypress](https://github.com/OWASP/wrongsecrets/actions/workflows/heroku_tests.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/heroku_tests.yml) [![Build Dev Container](https://github.com/OWASP/wrongsecrets/actions/workflows/build-devcontainer.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/build-devcontainer.yml) [![Test minikube script (k8s)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-k8s-test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-k8s-test.yml) [![Test minikube script (k8s&vault)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-vault-test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-vault-test.yml) [![Docker container test](https://github.com/OWASP/wrongsecrets/actions/workflows/container_test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/container_test.yml) [![Test container on podman](https://github.com/OWASP/wrongsecrets/actions/workflows/container-alts-test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/container-alts-test.yml) [![DAST with ZAP](https://github.com/OWASP/wrongsecrets/actions/workflows/dast-zap-test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/dast-zap-test.yml) [![PR Preview and Visual Diff](https://github.com/OWASP/wrongsecrets/actions/workflows/pr-preview.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/pr-preview.yml) [![Build Preview](https://github.com/OWASP/wrongsecrets/actions/workflows/build-preview.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/build-preview.yml) [![Visual Diff](https://github.com/OWASP/wrongsecrets/actions/workflows/visual-diff.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/visual-diff.yml) @@ -16,7 +16,7 @@ Welcome to the OWASP WrongSecrets game! The game is packed with real life examples of how to _not_ store secrets in your software. Each of these examples is captured in a challenge, which you need to solve using various tools and techniques. Solving these challenges will help you recognize common mistakes & can help you to reflect on your own secrets management strategy. -Can you solve all the 69 challenges? +Can you solve all the 71 challenges? Try some of them on [our Heroku demo environment](https://wrongsecrets.herokuapp.com/). @@ -226,9 +226,10 @@ Now you can try to find the secrets by means of solving the challenge offered at - [localhost:8080/challenge/challenge-64](http://localhost:8080/challenge/challenge-64) - [localhost:8080/challenge/challenge-65](http://localhost:8080/challenge/challenge-65) - [localhost:8080/challenge/challenge-66](http://localhost:8080/challenge/challenge-66) -- [localhost:8080/challenge/challenge-68](http://localhost:8080/challenge/challenge-70) -- [localhost:8080/challenge/challenge-69](http://localhost:8080/challenge/challenge-70) +- [localhost:8080/challenge/challenge-68](http://localhost:8080/challenge/challenge-68) +- [localhost:8080/challenge/challenge-69](http://localhost:8080/challenge/challenge-69) - [localhost:8080/challenge/challenge-70](http://localhost:8080/challenge/challenge-70) +- [localhost:8080/challenge/challenge-71](http://localhost:8080/challenge/challenge-71) Note that these challenges are still very basic, and so are their explanations. Feel free to file a PR to make them look @@ -257,7 +258,7 @@ If you want to host WrongSecrets on Railway, you can do so by deploying [this on ## Basic K8s exercise -_Can be used for challenges 0-6, 8, 12-43, 48-70_ +_Can be used for challenges 0-6, 8, 12-43, 48-71_ ### Minikube based diff --git a/scripts/sort_contibutors/go.mod b/scripts/sort_contibutors/go.mod index 4528106c4b..27a2ff3585 100644 --- a/scripts/sort_contibutors/go.mod +++ b/scripts/sort_contibutors/go.mod @@ -1,3 +1,3 @@ module github.com/owasp/wrongsecrets/scripts/sort_contibutors -go 1.22 +go 1.27.1