<!-- CRE Link: [223-780](https://www.opencre.org/cre/223-780?register=true&type=tool&tool_type=training&tags=secrets,training&description=With%20this%20app%2C%20we%20have%20packed%20various%20ways%20of%20how%20to%20not%20store%20your%20secrets.%20These%20can%20help%20you%20to%20realize%20whether%20your%20secret%20management%20is%20ok.%20The%20challenge%20is%20to%20find%20all%20the%20different%20secrets%20by%20means%20of%20various%20tools%20and%20techniques.%20Can%20you%20solve%20all%20the%2062%20challenges%3F) -->

OWASP WrongSecrets

<img src="https://img.shields.io/badge/-MASTODON-%232B90D9?style=for-the-badge&logo=mastodon&logoColor=white"> <img src="https://img.shields.io/badge/-BLUESKY-%230085FF?style=for-the-badge&logo=bluesky&logoColor=white"> <img src="https://img.shields.io/badge/-LINKEDIN-0077B5?style=for-the-badge&logo=linkedin&logoColor=white">

Welcome to the OWASP WrongSecrets game! The game is packed with real life examples of how to not store secrets in your software. Each of these examples is captured in a challenge, which you need to solve using various tools and techniques. Solving these challenges will help you recognize common mistakes & can help you to reflect on your own secrets management strategy.

Can you solve all the 62 challenges?

Try some of them on our Heroku demo environment.

Want to play the other challenges? Read the instructions on how to set them up below.

🚀 Quick Start

New to WrongSecrets? Start here:

1. Try Online First: Visit our Heroku demo to get familiar with the challenges
2. Run Locally: Use Docker for the full experience with all challenges:

   docker run -p 8080:8080 -p 8090:8090 jeroenwillemsen/wrongsecrets:latest-no-vault
   

   Then open http://localhost:8080
3. Want to see what's ahead? Try our bleeding-edge master container with the latest features:

   docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-master:latest-master
   

   ⚠️ Note: This is a development version and may be unstable
4. Advanced Setup: For cloud challenges and Kubernetes exercises, see the detailed instructions below

What you'll learn:

• Common secrets management mistakes
• How to identify exposed credentials
• Best practices for securing secrets
• Tools and techniques for secret detection

How it works: This repository contains intentionally vulnerable code and configuration files with real and fake secrets hidden throughout the codebase. You'll examine source code, configuration files, Docker containers, and cloud deployments to discover these secrets. Each challenge teaches you different ways secrets can be accidentally exposed in real-world applications.

📋 Prerequisites

For basic usage:

• A web browser
• Docker (for local setup) - Install here

For advanced setups:

• Kubernetes/Minikube - Install here
• Cloud account (AWS/GCP/Azure) for cloud challenges
• Command line familiarity

<a href="https://github.com/vshymanskyy/StandWithUkraine/blob/main/README.md"><img src="https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/banner2-no-action.svg" /></a>

Table of contents

🎯 Getting Started

• Quick Start
• Prerequisites
• Support

🐳 Deployment Options

• Basic docker exercises
  • Running these on Heroku
  • Running these on Render.io
  • Running these on Railway
• Basic K8s exercise
  • Minikube based
  • k8s based
  • Vault exercises with minikube

☁️ Cloud Challenges

• Cloud Challenges
  • Running WrongSecrets in AWS
  • Running WrongSecrets in GCP
  • Running WrongSecrets in Azure
  • Running Challenge15 in your own cloud only

🎮 Advanced Usage

• Do you want to play without guidance?
• CTF
  • CTFD Support
  • FBCTF Support
• Use OWASP WrongSecrets as a secret detection benchmark

👨‍💻 Development & Contribution

• Notes on development
• Spring Boot 4 adoption checklist - Dependency management - Get the project started in IntelliJ IDEA - Automatic reload during development - How to add a Challenge - Local testing - Local Automated testing
• Want to disable challenges in your own release?

📚 Resources & Community

• Special thanks & Contributors
• Sponsorships
• Help Wanted
• Further reading on secrets management

Support

Need support? Contact us via [OWA