Try the SEARCH function in the main navigation to find something. If you are looking for chapter information, please see Chapters for the correct chapter. For information about OWASP projects see Projects. For common attacks, vulnerabilities, or information about other community-led contributions see Contributed Content.
12 | 13 |If all else fails you can search our historical site.
15 |
13 |
14 | [](https://github.com/OWASP/wrongsecrets/stargazers)
15 | [](https://owasp.org/projects/)
16 | [](https://github.com/OWASP/wrongsecrets/releases/latest)
17 | [](https://bestpractices.coreinfrastructure.org/projects/7024)
18 | [](https://hub.docker.com/r/jeroenwillemsen/wrongsecrets)
19 | [](https://twitter.com/intent/tweet?text=Want%20to%20dive%20into%20secrets%20management%20and%20do%20some%20hunting?%20try%20this&url=https://github.com/OWASP/wrongsecrets&hashtags=secretsmanagement,secrets,hunting,p0wnableapp,OWASP,WrongSecrets)
20 | [
](https://tootpick.org/#text=Want%20to%20dive%20into%20secrets%20management%20and%20do%20some%20hunting?%20try%20this%0A%0Ahttps://github.com/OWASP/wrongsecrets%20%23secretsmanagement,%20%23secrets,%20%23hunting,%20%23p0wnableapp,%20%23OWASP,%20%23WrongSecrets)
21 |
22 | OWASP WrongSecrets is the first Secrets Management-focused vulnerable/p0wnable app! It can be used as a stand-alone game, as part of security trainings, awareness demos, as a test environment for secret detection tools, and bad practice detection tooling. It even has a supporting CTF platform to play the game in a larger group.
23 |
24 | Want to give it a shot? Go to [our demo environment running on Heroku](https://www.wrongsecrets.com/).
25 |
26 | 
27 |
28 | ## Description
29 |
30 | WrongSecrets is based on Java, Docker, Terraform, and a bit of scripting fun. It contains more than 50 exercises with various wrongly stored or misconfigured secrets - which you need to find. Finding these secrets will
31 |
32 | - Help you to look for secrets being misconfigured at your own environment, or target environments for bug bounties.
33 | - Help you to re-evaluate your own secrets management practices as well.
34 |
35 | ## Want to play?
36 |
37 | There are multiple ways on how you can play/work with OWASP WrongSecrets.
38 | Want to play locally? Try
39 |
40 | ```sh
41 | docker run -p 8080:8080 jeroenwillemsen/wrongsecrets:latest-no-vault
42 | ```
43 |
44 | Otherwise, try one of the following online environments:
45 |
46 | - [Online demo env (Heroku)](https://wrongsecrets.herokuapp.com/ "Online demo on a Heroku Dyno")
47 | - [Online CTF demo (Heroku)](https://wrongsecrets-ctf.herokuapp.com/ "Online CTF demo on a Heroku Dyno")
48 |
49 | Or try to deploy it using free services:
50 |
51 | [](https://render.com/deploy?repo=https://github.com/OWASP/wrongsecrets)
52 |
53 | [](https://railway.app/new/template/7pnwRj)
54 |
55 |
56 | ## Contributors
57 |
58 | [](https://github.com/OWASP/wrongsecrets/graphs/contributors) [](https://github.com/OWASP/wrongsecrets-ctf-party/graphs/contributors) [](https://github.com/OWASP/wrongsecrets-binaries/graphs/contributors)
59 |
60 | Leaders:
61 |
62 | - [Ben de Haan @bendehaan](https://www.github.com/bendehaan)
63 | - [Jeroen Willemsen @commjoen](https://www.github.com/commjoen)
64 |
65 | Top contributors:
66 |
67 | - [Jannik Hollenbach @J12934](https://www.github.com/J12934)
68 | - [Puneeth Y @puneeth072003](https://www.github.com/puneeth072003)
69 | - [Joss Sparkes @RemakingEden](https://www.github.com/RemakingEden)
70 |
71 | Contributors:
72 |
73 | - [Nanne Baars @nbaars](https://www.github.com/nbaars)
74 | - [Marcin Nowak @drnow4u](https://www.github.com/drnow4u)
75 | - [Rodolfo Neves @roddas](https://www.github.com/roddas)
76 | - [Osama Magdy @osamamagdy](https://www.github.com/osamamagdy)
77 | - [Pastekitoo @Pastekitoo](https://www.github.com/Pastekitoo)
78 | - [Shubham Patel @Shubham-Patel07](https://www.github.com/Shubham-Patel07)
79 | - [za @za](https://www.github.com/za)
80 | - [Divyanshu Dev @Novice-expert](https://www.github.com/Novice-expert)
81 | - [Tibor Hercz @tiborhercz](https://www.github.com/tiborhercz)
82 | - [Chris Elbring Jr. @neatzsche](https://www.github.com/neatzsche)
83 | - [Adarsh A @adarsh-a-tw](https://www.github.com/adarsh-a-tw)
84 | - [Diamond Rivero @diamant3](https://www.github.com/diamant3)
85 | - [Norbert Wolniak @nwolniak](https://www.github.com/nwolniak)
86 | - [Filip Chyla @fchyla](https://www.github.com/fchyla)
87 | - [Dmitry Litosh @Dlitosh](https://www.github.com/Dlitosh)
88 | - [Vineeth Jagadeesh @djvinnie](https://www.github.com/djvinnie)
89 | - [Mahaputra Ilham Awal @mahaputrailhamawal](https://www.github.com/mahaputrailhamawal)
90 | - [Turjo Chowdhury @turjoc120](https://www.github.com/turjoc120)
91 | - [SndR @SndR85](https://www.github.com/SndR85)
92 | - [Josh Grossman @tghosth](https://www.github.com/tghosth)
93 | - [alphasec @alphasecio](https://www.github.com/alphasecio)
94 | - [CaduRoriz @CaduRoriz](https://www.github.com/CaduRoriz)
95 | - [Madhu Akula @madhuakula](https://www.github.com/madhuakula)
96 | - [Mike Woudenberg @mikewoudenberg](https://www.github.com/mikewoudenberg)
97 | - [Spyros @northdpole](https://www.github.com/northdpole)
98 | - [RubenAtBinx @RubenAtBinx](https://www.github.com/RubenAtBinx)
99 | - [Alex Bender @alex-bender](https://www.github.com/alex-bender)
100 | - [Danny Lloyd @dannylloyd](https://www.github.com/dannylloyd)
101 | - [Nicolas Humblot @nhumblot](https://www.github.com/nhumblot)
102 | - [Rick M @kingthorin](https://www.github.com/kingthorin)
103 | - [Shlomo Zalman Heigh @szh](https://www.github.com/szh)
104 | - [Fern @f3rn0s](https://www.github.com/f3rn0s)
105 | - [Jeff Tong @Wind010](https://www.github.com/Wind010)
106 |
107 | Testers:
108 |
109 | - [Dave van Stein @davevs](https://www.github.com/davevs)
110 | - [Marcin Nowak @drnow4u](https://www.github.com/drnow4u)
111 | - [Marc Chang Sing Pang @mchangsp](https://www.github.com/mchangsp)
112 | - [Vineeth Jagadeesh @djvinnie](https://www.github.com/djvinnie)
113 |
114 | Special thanks:
115 |
116 | - [Madhu Akula @madhuakula @madhuakula](https://www.github.com/madhuakula)
117 | - [Nanne Baars @nbaars @nbaars](https://www.github.com/nbaars)
118 | - [Björn Kimminich @bkimminich](https://www.github.com/bkimminich)
119 | - [Dan Gora @devsecops](https://www.github.com/devsecops)
120 | - [Xiaolu Dai @saragluna](https://www.github.com/saragluna)
121 | - [Jonathan Giles @jonathanGiles](https://www.github.com/jonathanGiles)
122 |
123 | ### Sponsorships
124 |
125 | We would like to thank the following parties for helping us out:
126 |
127 | [](https://blog.gitguardian.com/gitguardian-is-proud-sponsor-of-owasp/)
128 |
129 | [GitGuardian](https://blog.gitguardian.com/gitguardian-is-proud-sponsor-of-owasp/) for their sponsorship which allows us to pay the bills for our cloud-accounts.
130 |
131 | [](https://www.jetbrains.com/)
132 |
133 | [Jetbrains](https://www.jetbrains.com/) for licensing an instance of Intellij IDEA Ultimate edition to the project leads. We could not have been this fast with the development without it!
134 |
135 | [](https://www.docker.com)
136 |
137 | [Docker](https://www.docker.com) for granting us their Docker Open Source Sponsored program.
138 |
139 | [](https://github.com/1Password/1password-teams-open-source/pull/552)
140 |
141 | [1Password](https://github.com/1Password/1password-teams-open-source/pull/552) for granting us an open source license to 1Password for the secret detection testbed.
142 |
143 | [](https://aws.amazon.com/)
144 |
145 | [AWS](https://aws.amazon.com/) for granting us AWS Open Source credits which we use to test our project and the [Wrongsecrets CTF Party](https://github.com/OWASP/wrongsecrets-ctf-party) setup on AWS.
146 |
147 | #### Individual supporters
148 |
149 | {% assign individual_supporter = site.data.ow_attributions | uniq %}
150 | {% for supporter in individual_supporter %}
151 |
152 | - {{ supporter | strip_html | strip_newlines | strip }}
153 | {% endfor %}
154 | - _You want to appear on this list?_
155 | [Donate to OWASP here! 🤲](https://owasp.org/donate/?reponame=www-project-wrongsecrets&title=OWASP+wrongsecrets)
156 |
157 | ## Licensing
158 |
159 | [](https://github.com/OWASP/wrongsecrets/blob/master/LICENSE)
160 |
161 | This program is free software: You can redistribute it and/or modify it under the terms of the [AGPLv3 License](https://github.com/OWASP/wrongsecrets/blob/master/LICENSE).
162 | OWASP WrongSecrets and any contributions are Copyright © by Jeroen Willemsen & the OWASP WrongSecrets contributors 2020-2025.
163 |
164 | ## Want to help out?
165 |
166 | You can help us in many ways:
167 |
168 | - Star us on github: Star Wrongsecrets on Github
169 | - Promote us using [](https://twitter.com/intent/tweet?text=Want%20to%20dive%20into%20secrets%20management%20and%20do%20some%20hunting?%20try%20this&url=https://github.com/OWASP/wrongsecrets&hashtags=secretsmanagement,secrets,hunting,p0wnableapp,OWASP,WrongSecrets)
170 | [](https://tootpick.org/#text=Want%20to%20dive%20into%20secrets%20management%20and%20do%20some%20hunting?%20try%20this%0A%0Ahttps://github.com/OWASP/wrongsecrets%20%23secretsmanagement,%20%23secrets,%20%23hunting,%20%23p0wnableapp,%20%23OWASP,%20%23WrongSecrets).
171 | - Promote us with a Blog, Vlog, Podcast, or presentation on a conference. Or use our materials to organize a CTF! If you do, let us know, so we can list your event or publication here on the webiste.
172 | - Work with us on the project! Take a look at the [Readme of the project](https://github.com/OWASP/wrongsecrets), [How to contribute](https://github.com/OWASP/wrongsecrets/blob/master/CONTRIBUTING.md), and the [Github Issues](https://github.com/OWASP/wrongsecrets/issues). If you want to contribute to an issue: make sure it is not yet assigned to someone, comment on it with your intention, and then we can assign it to you.
173 | - [Sponsor our project](https://owasp.org/donate/?reponame=www-project-wrongsecrets&title=OWASP+wrongsecrets)! We will use the money for covering our cloud costs (building & maintaining the project in 3 clouds costs money). And soon we hope to be able to buy you some stickers if you do ;-).
174 |
175 | ## Presentations about OWASP WrongSecrets
176 |
177 | The project has been promoted at:
178 |
179 | - [AllDayDevOps: Our secrets management journey from Code to Vault](https://www.alldaydevops.com/addo-speakers/jeroen-willemsen)
180 | - [Conf42 DevSecOps 2021: Secrets-management: challenges from code to cloud](https://www.youtube.com/watch?v=EsMS7gOBrY4)
181 | - [Club Cloud 2021: Securing your secrets in the cloud](https://youtu.be/lXMRTP5eg9Q)
182 | - [OWASP Dutch Chapter Meetup: Our Secrets Management Journey: From Code to Vault](https://www.youtube.com/watch?v=qR6JCkZgOlY)
183 | - [Open Security Summit: OWASP Wrong Secrets: project goals, under the hood, and where do we go from here?](https://www.youtube.com/watch?v=EYkjgGuhOYw)
184 | - [WrongSecrets demo - How not to store secrets with the project founder Jeroen Willemsen](https://www.youtube.com/watch?v=nqzxpgvLEv4&t=709s)
185 | - [Security Journey: Jeroen Willemsen and Ben de Haan - Dirty little secrets](https://www.youtube.com/watch?v=0HGPnQAYFNY)
186 | - [Meetup OWASP Bay Area: OWASP WrongSecrets: how to NOT mange your secrets](https://www.youtube.com/watch?v=oRUPVhp1Bfw)
187 | - [Code to Cloud Virtual Summit: Learn How to (Not) Use Secrets with OWASP WrongSecrets!](https://start.paloaltonetworks.com/code-to-cloud-summit.html)
188 | - [Teqnation 2022 Utrecht](https://teqnation.com/timetable-2022/)
189 | - [Devops Pro Europe: Introducing OWASP WrongSecrets: How You Should NOT Handle Your Secrets](https://devopspro.lt/Jeroen-Willemsen/)
190 | - [OWASP Virtual Appsec Europe 2022: OWASP WrongSecrets: We have a secret for Everyone!](https://whova.com/web/GKSmlhCK%2FWzBY2c8qqJ%2Bp7kNcnjsUQAQJ%2ByBsjLrbOo%3D/Agenda)
191 | - [Tweakers Developers Summit: OWASP WrongSecrets - waar je je applicatiegeheimen (niet) moet neerzetten](https://tweakers.net/partners/devsummit2022/1684/bendehaan/)
192 | - [OWASP Frankfurt #55 In-Person Event: Cloud Secrets,Cyber-Crime & Threat Modeling: Can't you keep a secret? Learn Secrets Management with OWASP WrongSecrets by Dan Gora, OWASP Frankfurt](https://www.meetup.com/nl-NL/it-security-stammtisch-frankfurt-owasp-u-w/events/286925136/)
193 | - OWASP Hamburg Stammtich
194 | - [DevSecOps Days 2022 Washington DC (Virtual): Learn How To (Not) Use Secrets With OWASP Wrong Secrets!](https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=887917) and [see the Youtube recording here](https://www.youtube.com/watch?v=bYDnMYkRUN0)
195 | - [AllDayDevOps - Learn how to (not) use secrets with OWASP WrongSecrets!](https://www.alldaydevops.com/addo-speakers/jeroen-willemsen)
196 | - [Azure Cloud Security Group - Can't You Keep a Secret ? Cloud Native Secrets Management with OWASP Wrong Secrets](https://www.youtube.com/watch?v=Aafvip8XGDI)
197 | - [Azure Cloud Security Meetup: Cloud-Native Secrets Management with OWASP WrongSecrets by Dan Gora](https://www.youtube.com/watch?v=Aafvip8XGDI&t=2505s)
198 | - [OWASP Benelux Days 2022 - CTF Kickoff](https://www.owaspbenelux.eu/program/conference#Jeroen-Willemsen-and-Ben-De-Haan) with actual [CTF info](https://www.owaspbenelux.eu/program/ctf)
199 | - [WeHackPurple: Don’t make the same mistakes we did: How you can do secrets management better with OWASP WrongSecrets](https://community.wehackpurple.com/events/dont-make-the-same-mistakes-we-did-how-you-can-do-secrets-management-better-with-owasp-wrongsecrets)
200 | - [Open Security Summit: OWASP WrongSecrets a journey into secrets management](https://open-security-summit.org/sessions/2024/mini-summits/jan/governance/owasp-wrongsecrets-a-journey-into-secret-management-failures/)
201 | - [Open Security Summit: OWASP WrongSecrets: Define the future challenges togeter](https://open-security-summit.org/sessions/2024/mini-summits/jan/governance/owasp-wrongsecrets-define-the-future-challenges-together/)
202 | - [Cyberwisecon: OWASP WrongSecrets: How We Keep on Growing Our Open Source Project](https://events.pinetool.ai/3152/#sessions/102169?referrer%5Bpathname%5D=%2Fsessions&referrer%5Bsearch%5D=&referrer%5Btitle%5D=Sessions)
203 | - [NLUUG: How to (not) Use Secrets with OWASP WrongSecrets](https://nluug.nl/evenementen/nluug/voorjaarsconferentie-2024/talks/ben-de-haan-jeroen-willemsen-how-to-not-use-secrets-with-owasp-wrongsecrets/) [recording from From 2:13](https://www.youtube.com/live/iJGV-SP1vRw?si=PE1rUH-py0GIvkuv)
204 | - [ADDO: OWASP WrongSecrets: How We Keep on Growing Our Open Source Project](https://event.alldaydevops.com/event/registration/websitePage:04030226-24b8-49ac-9c30-5671087b28ec?_gl=1*1r8zqhp*_gcl_au*MTkyNDMzMzAxOS4xNzI1NTI1OTY4&session=f7080cbc-c775-4c3d-8c6b-c6cca2158a74)
205 | - [OWASP Spotlight Series WrongSecrets](https://www.youtube.com/watch?v=inSkNPLDlWo)
206 | - Coverage on youtube: [walkthrough by sec right](https://youtu.be/tSQATLTuSqQ?si=DwCnQ4FlQQALGVfZ)
207 | - Various Blogs: [A blog by Gitguardian](https://blog.gitguardian.com/gitguardian-is-proud-sponsor-of-owasp/), [Another blog by Gitguardian](https://blog.gitguardian.com/a-beginners-guide-to-owasp/), [Blogs by the author(s)](https://dev.to/commjoen), [A blog by Okteto](https://www.okteto.com/blog/practice-secrets-management-in-kubernetes-with-owasp-wrongsecrets-and-okteto/), [A blog by Nec](https://jpn.nec.com/cybersecurity/blog/230707/index.html), [A blog from vineeth.dj](https://medium.com/@vineeth.dj/owasp-wrongsecrets-writeup-24ad3460be0a).
208 | - Various Podcasts: [Application Security Podcast: Jeroen Willemsen & Ben de Haan -- Dirty little secrets](https://appsecpodcast.securityjourney.com/1730684/9864567-jeroen-willemsen-and-ben-de-haan-dirty-little-secrets), [Devsec for scale: Secrets Management Pt 1](https://www.youtube.com/watch?v=dxgXUQZgUnI), [Devsec for scale: Secrets Management Pt 2](https://www.youtube.com/watch?v=_gY0T9vIl4E), [Devsec for scale: Secrets Management Pt 3](https://www.youtube.com/watch?v=vtUk2bc34AY).
209 |
210 | We would like to thank many people that have given a shoutout or a share about this project! Thank you for your forum-posts, blogs, and more!
211 |
--------------------------------------------------------------------------------
/info.md:
--------------------------------------------------------------------------------
1 | ### Project Information
2 |
3 | * Production Project
4 |
5 | #### Classification
6 |
7 | * Tool
8 |
9 | #### Audience
10 |
11 | * Builder
12 | * Breaker
13 | * Defender
14 |
15 | ### Getting Started
16 |
17 | * [WrongSecrets Github repo](https://github.com/OWASP/wrongsecrets "Github Repository")
18 | * [Online demo env (Heroku)](https://wrongsecrets.herokuapp.com/ "Online demo on a Heroku Dyno")
19 | * [Sometimes Online CTF demo (Heroku)](https://wrongsecrets-ctf.herokuapp.com/ "Online demo on a Heroku Dyno, which is not always up")
20 | * [Online demo (Render.io free)](https://wrongsecrets.onrender.com/ "Online demo on a free Render.io instance")
21 | * [Get Latest Docker](https://hub.docker.com/r/jeroenwillemsen/wrongsecrets "WrongSecrets docker container")
22 | * [Get Latest WrongSecrets Desktop](https://hub.docker.com/r/jeroenwillemsen/wrongsecrets-desktop "WrongSecrets-desktop docker container")
23 | * [Download Releases](https://github.com/OWASP/wrongsecrets/releases "WrongSecrets releases")
24 |
25 | ### Socials and Support
26 |
27 | * [Slack Channel](https://owasp.slack.com/messages/project-wrongsecrets "OWASP Slack")([Self-registration](https://owasp.org/slack/invite "Get yourself invited to OWASP Slack"))
28 | * [Twitter Jeroen](https://twitter.com/commjoenie "Twitter Jeroen Willemsen")
29 | * [Twitter Ben](https://twitter.com/BJFdeHaan "Twitter Ben de Haan")
30 |
31 | ### Code Repository
32 |
33 | * [Github repo](https://github.com/OWASP/wrongsecrets "Github Repository")
34 | * [Github repo binaries](https://github.com/OWASP/wrongsecrets-binaries "Github Repository for the binary challenges")
35 | * [Github CTF party repo](https://github.com/OWASP/wrongsecrets-ctf-party "Github Repository for WrongSecrets CTF Party")
36 |
37 | ### Getting Involved
38 |
39 | * [Code of Conduct](https://github.com/OWASP/wrongsecrets/blob/master/CODE_OF_CONDUCT.md)
40 | * [Contributing to the project](https://github.com/OWASP/wrongsecrets/blob/master/CONTRIBUTING.md)
41 |
42 | ### Sponsoring
43 |
44 | * [Sponsor the project](https://owasp.org/donate/?reponame=www-project-wrongsecrets&title=OWASP+wrongsecrets)
45 |
--------------------------------------------------------------------------------
/leaders.md:
--------------------------------------------------------------------------------
1 | ### Leaders
2 |
3 | * [Jeroen Willemsen](mailto:jeroen.willemsen@owasp.org) ([@commjoenie](https://twitter.com/commjoenie "Twitter Jeroen Willemsen"))
4 | * [Ben de Haan](mailto:ben.dehaan@owasp.org) ([@BJFdeHaan](https://twitter.com/BJFdeHaan "Twitter Ben de Haan"))
5 |
--------------------------------------------------------------------------------
/tab_ctf.md:
--------------------------------------------------------------------------------
1 | ---
2 | title: CTF
3 | layout: col-sidebar
4 | tab: true
5 | order: 2
6 | tags: wrongsecrets
7 | ---
8 |
9 | ## CTF
10 |
11 | ### With just OWASP WrongSecrets
12 |
13 | We support playing CTFs with OWASP WrongSecrets! Want to know more? Have a look at [the Git repo README](https://github.com/OWASP/wrongsecrets#ctf) and [the additional CTF documentation](https://github.com/OWASP/wrongsecrets/blob/master/ctf-instructions.md)
14 |
15 | ### With OWASP WrongSecrets-CTF-Party
16 |
17 | [](https://github.com/OWASP/wrongsecrets-ctf-party/stargazers) [](https://img.shields.io/docker/pulls/jeroenwillemsen/wrongsecrets-balancer.svg).
18 |
19 | Want to play OWASP WrongSecrets in a large group in CTF mode, but not go over all the hassle of setting up local copies of OWASP WrongSecrets? Here is [OWASP WrongSecrets CTF Party](https://github.com/OWASP/wrongsecrets-ctf-party)! This is a fork of [OWASP MultiJuicer](https://github.com/iteratec/multi-juicer), which is adapted to become a dynamic multi-tenant setup for doing a CTF together!
20 |
21 | Note that we:
22 |
23 | - have a [Webtop](https://docs.linuxserver.io/images/docker-webtop) integrated for each player
24 | - have a WrongSecrets instance integrated for each player
25 | - A working admin interface which can restart both or delete both (by deleting the full namespace)
26 | - It can cleanup old & unused namespaces automatically.
27 |
28 | You can currently play [OWASP WrongSecrets CTF Party](https://github.com/OWASP/wrongsecrets-ctf-party) using:
29 |
30 | - Any k8s setup that allows you to have multiple namespaces (including Minikube), by leveraging our [helm charts](https://owasp.org/wrongsecrets-ctf-party).
31 | - AWS, Azure, and GCP by using terraform which is part of the repo.
32 |
33 | ## Special thanks
34 |
35 | Special thanks to [@commjoen](https://github.com/commjoen), [@madhuakula](https://github.com/madhuakula), [@bendehaan](https://github.com/bendehaan), and [@mikewoudenberg](https://github.com/mikewoudenberg), and [@osamamagdy](https://github.com/osamamagdy) for making this port a reality!
36 |
--------------------------------------------------------------------------------
/tab_overview.md:
--------------------------------------------------------------------------------
1 | ---
2 | title: Overview
3 | layout: col-sidebar
4 | tab: true
5 | order: 1
6 | tags: wrongsecrets
7 | ---
8 |
9 | ## Overview
10 |
11 | The application can best be run as a [Docker container](https://hub.docker.com/r/jeroenwillemsen/wrongsecrets) as part of a K8s cluster. Some challenges are unique to specific public clouds (AWS, GCP, and Azure only for now).
12 |
13 | 
14 |
15 | The overview above nicely shows which technologies are mostly used to build up the full application. Consult the [GitHub repo readme](https://github.com/OWASP/wrongsecrets) for more information.
16 |
--------------------------------------------------------------------------------
/tab_passwords.md:
--------------------------------------------------------------------------------
1 | ---
2 | title: passwords
3 | layout: col-sidebar
4 | tab: true
5 | order: 4
6 | tags: wrongsecrets
7 | ---
8 |
9 | ## Creating Passwords
10 | You can create various types of passwords. OWASP WrongSecrets has quite a few of them as an example.
11 | There are complex passwords, which you can easily create with tools like OpenSSL and/or password managers.
12 | There are short passphrases, which you can easily remember
13 | There are longer passphrases with a more extensive set of words involved.
14 |
15 | ### Complex passwords
16 | Complex passwords can be easily generated securely using tools like OpenSSL (using `openssl rand 20 -base64`) or a password manager. For instance, the generation of challenge 31’s password. The password (SGF2ZSBhIG5pY2UgZGF5) was obtained using random information generated through OpenSSL.
17 |
18 | Of course, we need to reference the [(in)famous XKCD on this topic](https://xkcd.com/936/).
19 |
20 | ### Short passphrases
21 | Short passphrases uses short combinations of words. These are easy to think of and easy to remember. The solution to challenge0 is a good example here. Here a short passphrase(The first answer) is used as a solution.
22 |
23 | ### Longer passphrases
24 | In other challenges we packed longer passphrases, which are still easy to remember, but do have a lot more entropy to them.
25 |
26 | ## References
27 | NIST Digital Identity Guidelines: https://pages.nist.gov/800-63-3/sp800-63b.html
28 | OWASP Authentication cheatsheet: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html
29 |
30 |
--------------------------------------------------------------------------------
/tab_webdesktop.md:
--------------------------------------------------------------------------------
1 | ---
2 | title: webdesktop
3 | layout: col-sidebar
4 | tab: true
5 | order: 3
6 | tags: wrongsecrets
7 | ---
8 |
9 | ## Wrongsecrets Desktop
10 | [](https://hub.docker.com/r/jeroenwillemsen/wrongsecrets-desktop)[](https://hub.docker.com/r/jeroenwillemsen/wrongsecrets-desktop-k8s)
11 |
12 | Want to try out the secrets-hunting, but don't want to install all the recommended tools? Try to use our [WrongSecrets desktop](https://hub.docker.com/r/jeroenwillemsen/wrongsecrets-desktop).
13 |
14 | 
15 |
16 | You can run all the tools and a desktop environment in a container by doing the following:
17 |
18 | ```shell
19 | docker run -p 3000:3000 jeroenwillemsen/wrongsecrets-desktop:latest
20 | ```
21 |
22 | and open a browser at [http://localhost:3000](http://localhost:3000).
23 | Want to know more? Checkout the [Readme at the WrongSecrets github repo](https://github.com/OWASP/wrongsecrets#want-to-play-but-are-not-allowed-to-install-the-tools).
24 |
--------------------------------------------------------------------------------