STRLCPY/wrongsecrets

Co-authored-by: Ben de Haan <[email protected]>

Revision indexing in progress... (symbol navigation in revisions will be accurate after indexed)

Total 3 files Show one by one

■ ■ ■ ■ ■ ■

src/main/resources/explanations/challenge5_hint_limitted.adoc

		skipped 3 lines
4	4		- Can you see where in git we stored the `secrets-config.yml`? If not, just do a search.
5	5		- Take a look at the `Data` field: what can you find there?
6	6
7		-	PLEASE NOTE: The following options will only work when you have access to the K8s API. In this hosted version of WrongSecrets you do not have that access. When you are running a CTF: ask the organizer access to the targetted K8s API.
	7	+	PLEASE NOTE: The following options will only work when you have access to the K8s API. In this hosted version of WrongSecrets you do not have that access. When you are running a CTF: ask the organizer for access to the K8s API.
8	8
9	9
10	10		2. Ask nicely using Kubectl:
		skipped 12 lines

■ ■ ■ ■ ■ ■

src/main/resources/explanations/challenge6_hint_limitted.adoc

		skipped 16 lines
17	17		- Now do `env \| grep SPECIAL_SPECIAL_K8S_SECRET` and there is your secret.
18	18
19	19
20		-	BTW: with `kubectl get <item> -A` gives you an overview of all the items over all the namespaces you have access to. This shows how important it is not to give people access to every namespace in your cluster, as this might mean leaking important config/items to them.
	20	+	Note: `kubectl get <item> -A` gives you an overview of all the items over all the namespaces you have access to. It's important not to give people access to every namespace in your cluster, as this might mean leaking important config/items to them.
21	21

■ ■ ■ ■ ■ ■

src/main/resources/explanations/challenge8_hint_limitted.adoc

		skipped 1 lines
2	2
3	3		1. Get the secret from the logging
4	4		- Are you using the docker container? Use `docker logs <containerID>` to get the logs and find the value for challenge8
5		-	- Are you using K8s ? Find the Pod (`kubectl get pods \| grep secret`) and then do `kubectl logs -f <nameOfThePod>` to get the logs and find the value for challenge 8.
	5	+	- Are you using K8s? Find the Pod (`kubectl get pods \| grep secret`) and then do `kubectl logs -f <nameOfThePod>` to get the logs and find the value for challenge 8.
6	6
7	7		PLEASE NOTE: you are running this challenge on a hosted version of WrongSecrets. If you are not hosting it yourself, you might not have accesss to the defined outputs above. When you are running a CTF: ask the organizer access to the logging.
8	8