STRLCPY/wrongsecrets

Merge pull request #825 from OWASP/status-badge-andscreenshot

Update README.md (badges & screenshots), challenge1 text, and a ui-bug

Jeroen Willemsen committed with GitHub 1 year ago

b73d4370

2 parents
03531db4
91f5beb4

Revision indexing in progress... (symbol navigation in revisions will be accurate after indexed)

Total 6 files Show one by one

■ ■ ■ ■ ■ ■

README.md

		skipped 3 lines
4	4
5	5		[![Tweet](https://img.shields.io/twitter/url/http/shields.io.svg?style=social)](https://twitter.com/intent/tweet?text=Want%20to%20dive%20into%20secrets%20management%20and%20do%20some%20hunting?%20try%20this&url=https://github.com/OWASP/wrongsecrets&hashtags=secretsmanagement,secrets,hunting,p0wnableapp,OWASP,WrongSecrets) [<img src="https://img.shields.io/badge/-MASTODON-%232B90D9?style=for-the-badge&logo=mastodon&logoColor=white" width=84>](https://tootpick.org/#text=Want%20to%20dive%20into%20secrets%20management%20and%20do%20some%20hunting?%20try%20this%0A%0Ahttps://github.com/OWASP/wrongsecrets%20%23secretsmanagement,%20%23secrets,%20%23hunting,%20%23p0wnableapp,%20%23OWASP,%20%23WrongSecrets) [<img src="https://img.shields.io/badge/LinkedIn-0077B5?style=for-the-badge&logo=linkedin&logoColor=white" width=80>](https://www.linkedin.com/shareArticle/?url=https://www.github.com/OWASP/wrongsecrets&title=OWASP%20WrongSecrets)
6	6
7		-	[![Java checkstyle and testing](https://github.com/OWASP/wrongsecrets/actions/workflows/main.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/main.yml) [![Pre-commit](https://github.com/OWASP/wrongsecrets/actions/workflows/pre-commit.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/pre-commit.yml) [![Terraform FMT](https://github.com/OWASP/wrongsecrets/actions/workflows/terraform.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/terraform.yml) [![Test minikube script (k8s)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-k8s-test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-k8s-test.yml) [![Test minikube script (k8s&vault)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-vault-test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-vault-test.yml) [![Docker container test](https://github.com/OWASP/wrongsecrets/actions/workflows/container_test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/container_test.yml)
	7	+	[![Java checkstyle and testing](https://github.com/OWASP/wrongsecrets/actions/workflows/main.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/main.yml) [![Pre-commit](https://github.com/OWASP/wrongsecrets/actions/workflows/pre-commit.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/pre-commit.yml) [![Terraform FMT](https://github.com/OWASP/wrongsecrets/actions/workflows/terraform.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/terraform.yml) [![CodeQL](https://github.com/OWASP/wrongsecrets/actions/workflows/codeql-analysis.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/codeql-analysis.yml) [![Dead Link Checker](https://github.com/OWASP/wrongsecrets/actions/workflows/link_checker.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/link_checker.yml)[![Javadoc and Swaggerdoc generator](https://github.com/OWASP/wrongsecrets/actions/workflows/java_swagger_doc.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/java_swagger_doc.yml)[![Pre-commit check](https://github.com/OWASP/wrongsecrets/actions/workflows/pre-commit.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/pre-commit.yml)
	8	+
	9	+	[![Test minikube script (k8s)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-k8s-test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-k8s-test.yml) [![Test minikube script (k8s&vault)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-vault-test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-vault-test.yml) [![Docker container test](https://github.com/OWASP/wrongsecrets/actions/workflows/container_test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/container_test.yml)[![Test container on podman and Colima](https://github.com/OWASP/wrongsecrets/actions/workflows/container-alts-test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/container-alts-test.yml)
	10	+	[![DAST with ZAP](https://github.com/OWASP/wrongsecrets/actions/workflows/dast-zap-test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/dast-zap-test.yml)
	11	+
8	12		[![OWASP Lab Project](https://img.shields.io/badge/OWASP-lab%20project-48A646.svg)](https://owasp.org/projects/)
9	13		[![OpenSSF Best Practices](https://bestpractices.coreinfrastructure.org/projects/7024/badge)](https://bestpractices.coreinfrastructure.org/projects/7024)
10	14		[![Discussions](https://img.shields.io/github/discussions/OWASP/wrongsecrets)](https://github.com/OWASP/wrongsecrets/discussions)
		skipped 544 lines

images/screenshot.png

■ ■ ■ ■ ■ ■

src/main/resources/explanations/challenge1.adoc

		skipped 3 lines
4	4
5	5		Can you spot the secret we are looking for in code? What about looking for it in the container?
6	6
7		-	Sometimes the simpler tools are the most effective. Try cloning the repo and use https://man7.org/linux/man-pages/man1/grep.1.html[grep] to see what you find. It is also possible to find with https://github.com/awslabs/git-secrets[Git-secrets]. Just dive into the code!
	7	+	Sometimes the simpler tools are the most effective. Try cloning the repo and use https://man7.org/linux/man-pages/man1/grep.1.html[grep] to see what you find. It is also possible to find with https://github.com/awslabs/git-secrets[Git-secrets] or https://github.com/trufflesecurity/trufflehog[Trufflehog]. Just dive into the code!
8	8

■ ■ ■ ■ ■ ■

src/main/resources/explanations/challenge1_hint.adoc

		skipped 17 lines
18	18		- Follow the instructions of https://docs.docker.com/engine/reference/commandline/cp/[the Docker documentation] to copy the Jar file from the container's root to your local filesystem.
19	19		- open the JAR file in https://java-decompiler.github.io/[JD-GUI] or https://github.com/skylot/jadx[jadx-gui], now look for the `String password`!
20	20
	21	+	4. You can scan the repository with https://github.com/trufflesecurity/trufflehog[Trufflehog].
	22	+	- Clone the repo with `git clone https://github.com/OWASP/wrongsecrets`.
	23	+	- Follow the instructions https://github.com/trufflesecurity/trufflehog[here] to install Trufflehog.
	24	+	- Scan the files using `trufflehog . \| grep password` and the password will be in the output.
	25	+

■ ■ ■ ■ ■ ■

src/main/resources/templates/challenge.html

		skipped 61 lines
62	62		</div>
63	63		</form>
64	64		</div>
	65	+	<br/>
65	66		<div class="row">
66	67		<div th:replace="~{fragments/navigation :: navigation}"></div>
67	68
		skipped 46 lines

■ ■ ■ ■ ■ ■

src/main/resources/templates/fragments/header.html

		skipped 66 lines
67	67
68	68		</ul>
69	69		<a th:if="${ctf_enabled != null && ctf_enabled == true}" class="nav-link disabled me-2" href="#"
70		-	tabindex="-1" aria-disabled="true">In CTF-mode</a>
	70	+	tabindex="-1" aria-disabled="true" style="color:white">In CTF-mode</a>
71	71		<a class="nav-link disabled me-2" href="#" tabindex="-1" aria-disabled="true"
72		-	th:text="'Environment:'+${environment}"></a>
	72	+	th:text="'Environment:'+${environment}" style="color:white"></a>
73	73		<a class="nav-link disabled me-2" href="#" tabindex="-1" aria-disabled="true"
74		-	th:text="'Version:'+${version}"></a>
	74	+	th:text="'Version:'+${version}" style="color:white"></a>
75	75		</div>
76	76		</div>
77	77		</nav>
		skipped 5 lines