What you will do
A secret is a password, a key or a token that must stay private. Developers often leave them in the wrong place: written into code, shipped to the browser, or given away by a monitoring page. WrongSecrets is an application that does all of this on purpose, so you can learn to spot it. You will check it is running, look at what it gives away to anybody who asks, and read a script it sends to every visitor.
The one rule
Warning
This lab runs a website that is insecure on purpose. Attack it, and nothing else. It is your own private copy with no way out to the internet, so nobody else can be affected. Never try these things on a site that is not yours: in the UK that is a crime under the Computer Misuse Act 1990.
Before you start
Note
Press Start the lab on the bar at the top of this lesson and wait until it says it is running. The application opens from the OWASP WrongSecrets link on the bar. Each Run button below types its command into your lab's terminal, one after another in the same session. To watch them, or to type your own, press Open terminal on the bar.
1. Check the application is running
This asks the application how healthy it is. It answers {"groups":["liveness","readiness"],"status":"UP"}, which means it is ready.
curl -s -w "\n" http://wrongsecrets:8080/actuator/healthShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
2. Play Challenge 0
Press the OWASP WrongSecrets link on the lab bar and choose Challenge 0 in the Challenges menu. It explains the game and shows its own answer: copy it into the box and press Submit, and the page says Your answer is correct! Try a made-up answer first and it says Your answer is incorrect, try harder ;-).
3. See what it offers to anybody
Applications often have pages for the people who run them. Anybody who can reach the application can ask this one for a list of them, and it names three: auditevents, health and info (sort -u puts them in order and drops the repeat, since the list names health twice). Ask yourself which of the three you would not want a stranger to read. Challenge 42 is about one of them.
curl -s http://wrongsecrets:8080/actuator | grep -o 'actuator/[a-z]*' | sort -uShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
4. Read the script every visitor gets
Some applications keep a secret in a script that the browser runs. This one sends a script called index.js to every visitor. Its first characters are scrambled on purpose, so it is hard to read, but your browser has to download the whole thing to run it, and so does curl. A secret that the browser needs is a secret that everybody has. Challenge 16 asks you to find the one in it.
curl -s http://wrongsecrets:8080/js/index.js | head -n 1 | cut -c 1-120Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
5. Carry on
Try Challenge 16 and Challenge 42 in the browser, and use the hints under each challenge when you are stuck. Many challenges cannot be done in a lab, because they ask for something a lab copy does not have (it has no way out to the internet): skip those and pick another. For each secret you find, write down where it was and where it should have been kept instead.
For teachers
Tip
This lesson is a small example of a lesson worked in a lab: the steps and the Run buttons are the lesson, and the lab is each student's own copy. WrongSecrets has dozens of challenges across code, containers, configuration and logs, so the same lab serves a whole unit. Nothing is marked for you: ask for a screenshot of each challenge solved and a sentence on where the secret should have been kept. Copy it into your own module and change it, or build one from scratch with the Lab menu in the lesson builder.