Skip to content

Challenge 54 & Challenge55 hidden secrets in gitignore and .ssh#1929

Merged
commjoen merged 57 commits into
OWASP:masterfrom
Pastekitoo:fix/issue613
Apr 25, 2025
Merged

Challenge 54 & Challenge55 hidden secrets in gitignore and .ssh#1929
commjoen merged 57 commits into
OWASP:masterfrom
Pastekitoo:fix/issue613

Conversation

@Pastekitoo

@Pastekitoo Pastekitoo commented Mar 14, 2025

Copy link
Copy Markdown
Contributor

What kind of changes does this PR include?

  • Fixes or refactors
  • A new challenge
  • Additional documentation
  • Something else

Description

Challenge 54 is about a hidden secret in gitignore and Challenge 55 is about a hidden secret in .ssh.
Both secrets are encrypted and in base64 format to hide them from detection engines.
You can decrypt them with openssl and the passphrase given in the Description of the challenge.
The passphrase has to be available to all users in main page of the challenges.

Relations

Closes #613

Checklist:

  • All the contributions made are solely the work of me and my co-authors
  • I tested the changes in this PR (if applicable)
  • I added unit tests to ensure my change works (when change in Java or on front-end code)
  • I added UI tests to ensure my UI changes work (when change in the overall UI, not needed if just adding a challenge)
  • The PR passes pre-commit hooks and automated tests

@commjoen commjoen left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Love the challenges, can you fix the feedback, the pipeline and maybe add the plain pubkey and privatekwy in the same ssh config conmit by mistake challenge please?

Comment thread .ssh/config Outdated
Comment thread src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge54.java Outdated
Comment thread src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge55.java Outdated
Comment thread src/main/resources/wrong-secrets-configuration.yaml Outdated
Comment thread src/main/resources/wrong-secrets-configuration.yaml Outdated
Comment thread src/main/resources/wrong-secrets-configuration.yaml Outdated
Pastekitoo and others added 3 commits March 16, 2025 23:54
Co-authored-by: Jeroen Willemsen <jeroenwillemsen2001@gmail.com>
Co-authored-by: Jeroen Willemsen <jeroenwillemsen2001@gmail.com>
Comment thread src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge54.java Outdated
Comment thread src/main/resources/explanations/challenge54.adoc Outdated
@commjoen

Copy link
Copy Markdown
Collaborator

I guess all that is left is updating the explanation for challenge 55, with the options

  • getting it from git
  • getting it from the ocntainer by execing into it and/or docker Copy.

@commjoen commjoen self-requested a review April 24, 2025 05:25

@bendehaan bendehaan left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, thanks for your contribution!

@commjoen commjoen merged commit e7054ec into OWASP:master Apr 25, 2025
Wassupppp pushed a commit to Wassupppp/wrongsecrets that referenced this pull request Jun 26, 2026
Challenge 54 & Challenge55 hidden secrets in gitignore and .ssh
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Have a secret in .gitignore /.ssh

4 participants