Skip to content

Commit 03358e8

Browse files
committed
update challnege 39 and 52 their texts
1 parent 5c5b98b commit 03358e8

File tree

3 files changed

+5
-7
lines changed

3 files changed

+5
-7
lines changed

src/main/resources/explanations/challenge39.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,4 @@
22

33
A developer encrypted a secret using https://en.wikipedia.org/wiki/Advanced_Encryption_Standard[AES] and stored its base64 encoded value in a file. But where to leave the key? What about just using the filename as the encryption key instead? That way, every secret can have its own key easily! Can you find the secret?
44

5-
The challenge file is called https://github.com/OWASP/wrongsecrets/tree/master/src/main/resources/executables/secrchallenge.md[secrchallenge.md] and can be found in the https://github.com/OWASP/wrongsecrets/tree/master/src/main/resources/executables[executables folder].
5+
The challenge file is called https://github.com/OWASP/wrongsecrets/blob/master/src/main/resources/executables/secrchallenge.md[secrchallenge.md] and can be found in the https://github.com/OWASP/wrongsecrets/tree/master/src/main/resources/executables[executables folder].

src/main/resources/explanations/challenge52.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,6 @@
22

33
Acme Inc., a fast-growing SaaS company, is expanding its containerized deployments using Docker Buildx to streamline multi-platform builds. However, a serious security misconfiguration has occurred during the build process.
44

5-
During their Docker Buildx process, a sensitive secret, meant to remain temporary and secure during the build phase of the container, was accidentally embedded into the container's filesystem due to a misconfiguration. This secret, now accessible within the running container and visible in its build scripts, poses a significant security risk if exploited.
5+
During their [Docker Buildx process](https://github.com/OWASP/wrongsecrets/blob/master/.github/scripts/docker-create.sh#L365), a sensitive secret, meant to remain temporary and secure during the build phase of the container, was accidentally embedded into the container's filesystem due to a misconfiguration. This secret, now accessible within the running container and visible in its build scripts, poses a significant security risk if exploited.
66

77
As Acme Inc.'s newly hired Security Consultant, your task is clear: investigate the container, identify the exposed secret, and report it to the team. By uncovering this vulnerability, you will help Acme Inc. understand the risks and implement better practices to secure their deployment pipeline.

src/main/resources/explanations/challenge52_hint.adoc

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
This challenge can be solved using the following steps:
1+
This challenge can be solved using the following ways:
22

3-
- *Acme Inc.* has misconfigured their Docker Buildx process, leading to sensitive secrets being embedded in the container's filesystem. Your task is to uncover these vulnerabilities.
3+
- Use the container itself:
44
55
1. Clone the repository containing the challenge files:
66
```
@@ -27,9 +27,7 @@ This challenge can be solved using the following steps:
2727
2828
6. The content of the `secret.txt` file is your answer.
2929
30-
== OR
31-
32-
- You can directly access the hardcoded secret by accessing the `docker-create` script
30+
- Find the secret in the buildx script:
3331
3432
1. Clone the repository containing the challenge files:
3533
```

0 commit comments

Comments
 (0)