Add Swift binary challenge (Challenge 64)#2470
Conversation
…d BinaryExecutionHelper LD_LIBRARY_PATH support Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com> Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/943e2996-a1c1-4ad7-a536-60fedf93589c
…er test for Challenge63 Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com> Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/943e2996-a1c1-4ad7-a536-60fedf93589c
|
🌐 GitHub Pages Preview Ready! Your static preview is now available at: 📄 What's included:
For full functionality testing: Use the Docker preview instead. 🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR. Static preview with Thymeleaf generation by GitHub Actions |
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-d3aefaf
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-d3aefafThen visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
@copilot can you fix the failing github actions please? |
…HS array Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com> Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/6c02591b-e955-441e-9735-6759d336f157
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2470 |
|
🌐 GitHub Pages Preview Ready! Your static preview is now available at: 📄 What's included:
For full functionality testing: Use the Docker preview instead. 🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR. Static preview with Thymeleaf generation by GitHub Actions |
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-f8d3491
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-f8d3491Then visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2470 |
|
java.io.IOException: Cannot run program "/tmp/c-exec-wrongsecrets-swift-linux-musl-arm7674393112878681325sh": Exec failed, error: 2 (No such file or directory) |
|
@copilot i see the following error when running the container locally: java.io.IOException: Cannot run program "/tmp/c-exec-wrongsecrets-swift-linux-musl-arm7674393112878681325sh": Exec failed, error: 2 (No such file or directory) |
|
🌐 GitHub Pages Preview Ready! Your static preview is now available at: 📄 What's included:
For full functionality testing: Use the Docker preview instead. 🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR. Static preview with Thymeleaf generation by GitHub Actions |
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-1abe86e
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-1abe86eThen visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2470 |
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-569a3f3
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-569a3f3Then visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2470 |
|
@copilot I just got : |
commjoen
changed the title
commjoen
changed the title
|
🌐 GitHub Pages Preview Ready! Your static preview is now available at: 📄 What's included:
For full functionality testing: Use the Docker preview instead. 🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR. Static preview with Thymeleaf generation by GitHub Actions |
|
📸 Visual Diff Available! Screenshots have been generated comparing your changes with the main branch. Download Visual Diff Artifacts The artifacts contain:
Compare these images to see the visual impact of your changes! Visual diff generated by GitHub Actions |
|
🌐 GitHub Pages Preview Ready! Your static preview is now available at: 📄 What's included:
For full functionality testing: Use the Docker preview instead. 🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR. Static preview with Thymeleaf generation by GitHub Actions |
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-831137f
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-831137fThen visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
📸 Visual Diff Available! Screenshots have been generated comparing your changes with the main branch. Download Visual Diff Artifacts The artifacts contain:
Compare these images to see the visual impact of your changes! Visual diff generated by GitHub Actions |
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2470 |
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-c0f9eb9
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-c0f9eb9Then visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2470 |
|
🌐 GitHub Pages Preview Ready! Your static preview is now available at: 📄 What's included:
For full functionality testing: Use the Docker preview instead. 🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR. Static preview with Thymeleaf generation by GitHub Actions |
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-c92a416
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-c92a416Then visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2470 |
…wrongsecrets Add Swift binary challenge (Challenge 64)
Implements the Swift binary reverse engineering challenge, teaching users that hardcoded secrets in Swift binaries are recoverable via tools like Ghidra or radare2.
Changes
New challenge
Challenge63.java— runswrongsecrets-swiftbinary to retrieve the answer; follows the sameFixedAnswerChallenge+BinaryExecutionHelperpattern as C/C++/Rust/Go challengesChallenge63Test.java— tests correct spoiler output and incorrect answer rejectionwrong-secrets-configuration.yaml— registers Challenge 63 (category:bin, difficulty:master, CTF-enabled)Swift binaries
Downloaded from
wrongsecrets-binariesintosrc/main/resources/executables/:wrongsecrets-swift/-arm(macOS)wrongsecrets-swift-linux/-linux-arm/-linux-musl/-linux-musl-armThe
linux-muslvariants are fully statically linked (~42 MB each), embedding the entire Swift runtime. This makes them self-contained on any musl-based system (e.g. Alpine) without requiring external shared libraries.Swift runtime library support
The non-musl Linux Swift binary dynamically links
libswiftCore.so, which isn't in the defaultldsearch path in all environments.BinaryExecutionHelpernow auto-detects installed Swift runtime paths and injectsLD_LIBRARY_PATHbefore executing anyswift-named binary:Docker container support
The wrongsecrets Docker container uses Alpine Linux (musl libc). On Alpine,
BinaryExecutionHelperautomatically selects thewrongsecrets-swift-linux-muslvariant. Because those binaries are fully statically linked, no extra shared libraries or compatibility shims are needed — the Dockerfile remains unchanged from the original Alpine-based setup (eclipse-temurin:25.0.2_10-jre-alpine,apk add --no-cache libstdc++ icu-libs).Challenge 63 container test
src/main/resources/challenges/challenge-63/Dockerfile_challenge63— a minimalalpine:3.21container that copieswrongsecrets-swift-linux-musland verifies it produces non-empty output (the hardcoded secret)container_test.yml— new CI jobChallenge 63 Swift binary testthat builds this image from the repo root and runs it, failing if the binary produces no outputDocker container JAR size reduction
.github/scripts/docker-create.sh— Extended the binary removal list from 7 entries to 41 entries to reduce the JAR size in the Docker image. All non-musl, non-Windows binaries that are never used on Alpine are now stripped from the JAR at build time, organized into three groups:.exefiles (unchanged wildcard removal)wrongsecrets-golang-linuxandwrongsecrets-golang-linux-armare intentionally kept:BinaryExecutionHelperskips the-muslsuffix for golang, so these glibc-linked binaries are used even on Alpine (amd64 and arm64 respectively).Explanation content
challenge63.adoc— problem statement (part 5 of the binary series)challenge63_hint.adoc— solve paths via Ghidra, radare2, andnm+swift-demanglechallenge63_reason.adoc— security lesson on Swift binary reverse engineeringOriginal prompt
💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.