Skip to content

Commit 96ce218

Browse files
commjoencommjoen
authored
Merge pull request #938 from OWASP/feature-reporting-challenge
Add experimental key
2 parents a7c0a58 + 4049ba3 commit 96ce218

File tree

6 files changed

+166
-20
lines changed

6 files changed

+166
-20
lines changed

‎src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge35.java‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
package org.owasp.wrongsecrets.challenges.docker;
2+
3+
import java.nio.charset.StandardCharsets;
4+
import java.security.InvalidAlgorithmParameterException;
5+
import java.security.InvalidKeyException;
6+
import java.security.NoSuchAlgorithmException;
7+
import java.util.List;
8+
import javax.crypto.BadPaddingException;
9+
import javax.crypto.Cipher;
10+
import javax.crypto.IllegalBlockSizeException;
11+
import javax.crypto.NoSuchPaddingException;
12+
import javax.crypto.spec.IvParameterSpec;
13+
import javax.crypto.spec.SecretKeySpec;
14+
import lombok.extern.slf4j.Slf4j;
15+
import org.bouncycastle.util.encoders.Base64;
16+
import org.owasp.wrongsecrets.RuntimeEnvironment;
17+
import org.owasp.wrongsecrets.ScoreCard;
18+
import org.owasp.wrongsecrets.challenges.Challenge;
19+
import org.owasp.wrongsecrets.challenges.ChallengeTechnology;
20+
import org.owasp.wrongsecrets.challenges.Difficulty;
21+
import org.owasp.wrongsecrets.challenges.Spoiler;
22+
import org.springframework.core.annotation.Order;
23+
import org.springframework.stereotype.Component;
24+
25+
/** This is a challenge based on the idea of leaking a secret trough a vulnerability report. */
26+
@Slf4j
27+
@Component
28+
@Order(36)
29+
public class Challenge35 extends Challenge {
30+
31+
public Challenge35(ScoreCard scoreCard) {
32+
super(scoreCard);
33+
}
34+
35+
@Override
36+
public boolean canRunInCTFMode() {
37+
return true;
38+
}
39+
40+
@Override
41+
public Spoiler spoiler() {
42+
return new Spoiler(getKey());
43+
}
44+
45+
@Override
46+
public boolean answerCorrect(String answer) {
47+
return getKey().equals(answer);
48+
}
49+
50+
/** {@inheritDoc} */
51+
@Override
52+
public int difficulty() {
53+
return Difficulty.EASY;
54+
}
55+
56+
/** {@inheritDoc} This is a Documentation type of challenge */
57+
@Override
58+
public String getTech() {
59+
return ChallengeTechnology.Tech.DOCUMENTATION.id;
60+
}
61+
62+
@Override
63+
public boolean isLimitedWhenOnlineHosted() {
64+
return false;
65+
}
66+
67+
@Override
68+
public List<RuntimeEnvironment.Environment> supportedRuntimeEnvironments() {
69+
return List.of(RuntimeEnvironment.Environment.DOCKER);
70+
}
71+
72+
private String getKey() {
73+
String ciphertext = "zRR77ETjg5GsXv3az1TZU73xiFWYHbVceJBvBbjChxLyMjHkF6kFdwIXIduVBHAT";
74+
try {
75+
return decrypt(ciphertext);
76+
} catch (Exception e) {
77+
log.warn("there was an exception with decrypting content in challenge35", e);
78+
return "error_decryption";
79+
}
80+
}
81+
82+
@edu.umd.cs.findbugs.annotations.SuppressFBWarnings(
83+
value = "CIPHER_INTEGRITY",
84+
justification =
85+
"The scheme is bad without hmac, but we wanted to make it a bit more fun for you")
86+
private String decrypt(String ciphertext)
87+
throws InvalidAlgorithmParameterException,
88+
InvalidKeyException,
89+
NoSuchPaddingException,
90+
NoSuchAlgorithmException,
91+
IllegalBlockSizeException,
92+
BadPaddingException {
93+
IvParameterSpec iv = new IvParameterSpec("1234567890123456".getBytes(StandardCharsets.UTF_8));
94+
SecretKeySpec skeySpec =
95+
new SecretKeySpec(
96+
"12345678901234561234567890123456".getBytes(StandardCharsets.UTF_8), "AES");
97+
98+
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5PADDING");
99+
cipher.init(Cipher.DECRYPT_MODE, skeySpec, iv);
100+
return new String(
101+
cipher.doFinal(Base64.decode(ciphertext.getBytes(StandardCharsets.UTF_8))),
102+
StandardCharsets.UTF_8);
103+
}
104+
}

‎src/main/resources/explanations/challenge35.adoc‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
=== Reporting on Vulnerabilities
2+
3+
A security researcher found a Google API key and together with the project leader https://github.com/commjoen[@commjoen] made a GitHub security advisory. The only thing @commjoen did wrong was publish the API key as part of the advisory. Can you spot the key?

‎src/main/resources/explanations/challenge35_hint.adoc‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
This is a documentation challenge, which can be solved by going to the Github Advisory.
2+
3+
1. Get to the key using the Github security advisory
4+
- Go to https://github.com/OWASP/wrongsecrets/security/advisories/GHSA-vv4g-7gjw-fvqw[the advisory].
5+
- Find the Google API key.
6+
- Copy it into the answer box.
7+
8+
2. Follow the Github security advisory information
9+
- Go to https://github.com/OWASP/wrongsecrets/security/advisories/GHSA-vv4g-7gjw-fvqw[the advisory].
10+
- Find the version that is impacted (1.6.8RC1).
11+
- Open the tag at https://github.com/OWASP/wrongsecrets/tree/1.6.8RC1[Github].
12+
- Find the Google API key in challenge 35.
13+
- Copy it into the answer box.

‎src/main/resources/explanations/challenge35_reason.adoc‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
*Why we need to be careful with vulnerability reports*
2+
3+
When you report a vulnerability or publish a security advisory, always be careful with the information you spread with them. Exact values of found hardcoded secrets, especially those harder to rotate, should not be put into your security report and/or the publication.

‎src/main/resources/templates/about.html‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -343,32 +343,32 @@
343343
<li>(The Apache Software License, Version 2.0) thymeleaf-extras-springsecurity6 (org.thymeleaf.extras:thymeleaf-extras-springsecurity6:3.1.2.RELEASE - http://www.thymeleaf.org/thymeleaf-lib/thymeleaf-extras-springsecurity6)</li>
344344
<li>(Public Domain) XZ for Java (org.tukaani:xz:1.9 - https://tukaani.org/xz/java.html)</li>
345345
<li>(The Apache Software License, Version 2.0) unbescape (org.unbescape:unbescape:1.1.6.RELEASE - http://www.unbescape.org)</li>
346-
<li>(Apache License, Version 2.0) Bootstrap (org.webjars:bootstrap:5.3.0 - http://webjars.org)</li>
346+
<li>(Apache License, Version 2.0) Bootstrap (org.webjars:bootstrap:5.3.1 - http://webjars.org)</li>
347347
<li>(MIT) DataTables (org.webjars:datatables:1.13.5 - http://webjars.org)</li>
348348
<li>(MIT License) jquery (org.webjars:jquery:3.7.0 - http://webjars.org)</li>
349349
<li>(Apache 2.0) Swagger UI (org.webjars:swagger-ui:4.18.2 - http://webjars.org)</li>
350350
<li>(BSD 2-Clause) github-buttons (org.webjars.npm:github-buttons:2.14.1 - https://www.webjars.org)</li>
351351
<li>(Common Public 1.0) pecoff4j (org.whitesource:pecoff4j:0.0.2.1 - https://github.com/whitesource/pecoff4j-maven)</li>
352352
<li>(Apache License, Version 2.0) SnakeYAML (org.yaml:snakeyaml:1.33 - https://bitbucket.org/snakeyaml/snakeyaml)</li>
353-
<li>(Apache License, Version 2.0) AWS Java SDK :: Annotations (software.amazon.awssdk:annotations:2.20.115 - https://aws.amazon.com/sdkforjava/core/annotations)</li>
354-
<li>(Apache License, Version 2.0) AWS Java SDK :: HTTP Clients :: Apache (software.amazon.awssdk:apache-client:2.20.115 - https://aws.amazon.com/sdkforjava/http-clients/apache-client)</li>
355-
<li>(Apache License, Version 2.0) AWS Java SDK :: Auth (software.amazon.awssdk:auth:2.20.115 - https://aws.amazon.com/sdkforjava)</li>
356-
<li>(Apache License, Version 2.0) AWS Java SDK :: AWS Core (software.amazon.awssdk:aws-core:2.20.115 - https://aws.amazon.com/sdkforjava)</li>
357-
<li>(Apache License, Version 2.0) AWS Java SDK :: Core :: Protocols :: AWS Json Protocol (software.amazon.awssdk:aws-json-protocol:2.20.115 - https://aws.amazon.com/sdkforjava)</li>
358-
<li>(Apache License, Version 2.0) AWS Java SDK :: Core :: Protocols :: AWS Query Protocol (software.amazon.awssdk:aws-query-protocol:2.20.115 - https://aws.amazon.com/sdkforjava)</li>
359-
<li>(Apache License, Version 2.0) AWS Java SDK :: Endpoints SPI (software.amazon.awssdk:endpoints-spi:2.20.115 - https://aws.amazon.com/sdkforjava/core/endpoints-spi)</li>
360-
<li>(Apache License, Version 2.0) AWS Java SDK :: HTTP Client Interface (software.amazon.awssdk:http-client-spi:2.20.115 - https://aws.amazon.com/sdkforjava/http-client-spi)</li>
361-
<li>(Apache License, Version 2.0) AWS Java SDK :: Core :: Protocols :: Json Utils (software.amazon.awssdk:json-utils:2.20.115 - https://aws.amazon.com/sdkforjava)</li>
362-
<li>(Apache License, Version 2.0) AWS Java SDK :: Metrics SPI (software.amazon.awssdk:metrics-spi:2.20.115 - https://aws.amazon.com/sdkforjava/core/metrics-spi)</li>
363-
<li>(Apache License, Version 2.0) AWS Java SDK :: HTTP Clients :: Netty Non-Blocking I/O (software.amazon.awssdk:netty-nio-client:2.20.115 - https://aws.amazon.com/sdkforjava/http-clients/netty-nio-client)</li>
364-
<li>(Apache License, Version 2.0) AWS Java SDK :: Profiles (software.amazon.awssdk:profiles:2.20.115 - https://aws.amazon.com/sdkforjava)</li>
365-
<li>(Apache License, Version 2.0) AWS Java SDK :: Core :: Protocols :: Protocol Core (software.amazon.awssdk:protocol-core:2.20.115 - https://aws.amazon.com/sdkforjava)</li>
366-
<li>(Apache License, Version 2.0) AWS Java SDK :: Regions (software.amazon.awssdk:regions:2.20.115 - https://aws.amazon.com/sdkforjava/core/regions)</li>
367-
<li>(Apache License, Version 2.0) AWS Java SDK :: SDK Core (software.amazon.awssdk:sdk-core:2.20.115 - https://aws.amazon.com/sdkforjava)</li>
368-
<li>(Apache License, Version 2.0) AWS Java SDK :: Services :: AWS Simple Systems Management (SSM) (software.amazon.awssdk:ssm:2.20.115 - https://aws.amazon.com/sdkforjava)</li>
369-
<li>(Apache License, Version 2.0) AWS Java SDK :: Services :: AWS STS (software.amazon.awssdk:sts:2.20.115 - https://aws.amazon.com/sdkforjava)</li>
370-
<li>(Apache License, Version 2.0) AWS Java SDK :: Third Party :: Jackson-core (software.amazon.awssdk:third-party-jackson-core:2.20.115 - https://aws.amazon.com/sdkforjava)</li>
371-
<li>(Apache License, Version 2.0) AWS Java SDK :: Utilities (software.amazon.awssdk:utils:2.20.115 - https://aws.amazon.com/sdkforjava/utils)</li>
353+
<li>(Apache License, Version 2.0) AWS Java SDK :: Annotations (software.amazon.awssdk:annotations:2.20.116 - https://aws.amazon.com/sdkforjava/core/annotations)</li>
354+
<li>(Apache License, Version 2.0) AWS Java SDK :: HTTP Clients :: Apache (software.amazon.awssdk:apache-client:2.20.116 - https://aws.amazon.com/sdkforjava/http-clients/apache-client)</li>
355+
<li>(Apache License, Version 2.0) AWS Java SDK :: Auth (software.amazon.awssdk:auth:2.20.116 - https://aws.amazon.com/sdkforjava)</li>
356+
<li>(Apache License, Version 2.0) AWS Java SDK :: AWS Core (software.amazon.awssdk:aws-core:2.20.116 - https://aws.amazon.com/sdkforjava)</li>
357+
<li>(Apache License, Version 2.0) AWS Java SDK :: Core :: Protocols :: AWS Json Protocol (software.amazon.awssdk:aws-json-protocol:2.20.116 - https://aws.amazon.com/sdkforjava)</li>
358+
<li>(Apache License, Version 2.0) AWS Java SDK :: Core :: Protocols :: AWS Query Protocol (software.amazon.awssdk:aws-query-protocol:2.20.116 - https://aws.amazon.com/sdkforjava)</li>
359+
<li>(Apache License, Version 2.0) AWS Java SDK :: Endpoints SPI (software.amazon.awssdk:endpoints-spi:2.20.116 - https://aws.amazon.com/sdkforjava/core/endpoints-spi)</li>
360+
<li>(Apache License, Version 2.0) AWS Java SDK :: HTTP Client Interface (software.amazon.awssdk:http-client-spi:2.20.116 - https://aws.amazon.com/sdkforjava/http-client-spi)</li>
361+
<li>(Apache License, Version 2.0) AWS Java SDK :: Core :: Protocols :: Json Utils (software.amazon.awssdk:json-utils:2.20.116 - https://aws.amazon.com/sdkforjava)</li>
362+
<li>(Apache License, Version 2.0) AWS Java SDK :: Metrics SPI (software.amazon.awssdk:metrics-spi:2.20.116 - https://aws.amazon.com/sdkforjava/core/metrics-spi)</li>
363+
<li>(Apache License, Version 2.0) AWS Java SDK :: HTTP Clients :: Netty Non-Blocking I/O (software.amazon.awssdk:netty-nio-client:2.20.116 - https://aws.amazon.com/sdkforjava/http-clients/netty-nio-client)</li>
364+
<li>(Apache License, Version 2.0) AWS Java SDK :: Profiles (software.amazon.awssdk:profiles:2.20.116 - https://aws.amazon.com/sdkforjava)</li>
365+
<li>(Apache License, Version 2.0) AWS Java SDK :: Core :: Protocols :: Protocol Core (software.amazon.awssdk:protocol-core:2.20.116 - https://aws.amazon.com/sdkforjava)</li>
366+
<li>(Apache License, Version 2.0) AWS Java SDK :: Regions (software.amazon.awssdk:regions:2.20.116 - https://aws.amazon.com/sdkforjava/core/regions)</li>
367+
<li>(Apache License, Version 2.0) AWS Java SDK :: SDK Core (software.amazon.awssdk:sdk-core:2.20.116 - https://aws.amazon.com/sdkforjava)</li>
368+
<li>(Apache License, Version 2.0) AWS Java SDK :: Services :: AWS Simple Systems Management (SSM) (software.amazon.awssdk:ssm:2.20.116 - https://aws.amazon.com/sdkforjava)</li>
369+
<li>(Apache License, Version 2.0) AWS Java SDK :: Services :: AWS STS (software.amazon.awssdk:sts:2.20.116 - https://aws.amazon.com/sdkforjava)</li>
370+
<li>(Apache License, Version 2.0) AWS Java SDK :: Third Party :: Jackson-core (software.amazon.awssdk:third-party-jackson-core:2.20.116 - https://aws.amazon.com/sdkforjava)</li>
371+
<li>(Apache License, Version 2.0) AWS Java SDK :: Utilities (software.amazon.awssdk:utils:2.20.116 - https://aws.amazon.com/sdkforjava/utils)</li>
372372
<li>(Apache License, Version 2.0) AWS Event Stream (software.amazon.eventstream:eventstream:1.0.1 - https://github.com/awslabs/aws-eventstream-java)</li>
373373
<li>(Unknown license) StAX (stax:stax:1.2.0 - http://stax.codehaus.org/)</li>
374374
<li>(The Apache Software License, Version 2.0) StAX API (stax:stax-api:1.0.1 - http://stax.codehaus.org/)</li>

‎src/test/java/org/owasp/wrongsecrets/challenges/docker/Challenge35Test.java‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
package org.owasp.wrongsecrets.challenges.docker;
2+
3+
import org.assertj.core.api.Assertions;
4+
import org.junit.jupiter.api.Test;
5+
import org.mockito.Mock;
6+
import org.owasp.wrongsecrets.ScoreCard;
7+
8+
public class Challenge35Test {
9+
@Mock private ScoreCard scoreCard;
10+
11+
@Test
12+
void spoilerShouldGiveAnswer() {
13+
var challenge = new Challenge35(scoreCard);
14+
Assertions.assertThat(challenge.spoiler().solution()).isNotEmpty();
15+
Assertions.assertThat(challenge.answerCorrect(challenge.spoiler().solution())).isTrue();
16+
}
17+
18+
@Test
19+
void incorrectAnswerShouldNotSolveChallenge() {
20+
var challenge = new Challenge35(scoreCard);
21+
Assertions.assertThat(challenge.solved("wrong answer")).isFalse();
22+
}
23+
}

0 commit comments

Comments
 (0)