OWASP WrongSecrets

Welcome to the OWASP WrongSecrets game! The game is packed with real life examples of how to not store secrets in your software. Each of these examples is captured in a challenge, which you need to solve using various tools and techniques. Solving these challenges will help you recognize common mistakes & can help you to reflect on your own secrets management strategy.

Can you solve all the 73 challenges?

Try some of them on our Heroku demo environment.

Want to play the other challenges? Read the instructions on how to set them up below.

🚀 Quick Start

New to WrongSecrets? Start here:

1. Try Online First: Visit our Heroku demo to get familiar with the challenges
2. Run Locally: Use Docker for the full experience with all challenges:

   docker run -p 8080:8080 -p 8090:8090 jeroenwillemsen/wrongsecrets:latest-no-vault
   

   Then open http://localhost:8080
3. Want to see what's ahead? Try our bleeding-edge master container with the latest features:

   docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-master:latest-master
   

   ⚠️ Note: This is a development version and may be unstable
4. Advanced Setup: For cloud challenges and Kubernetes exercises, see the detailed instructions below

What you'll learn:

• Common secrets management mistakes
• How to identify exposed credentials
• Best practices for securing secrets
• Tools and techniques for secret detection

How it works: This repository contains intentionally vulnerable code and configuration files with real and fake secrets hidden throughout the codebase. You'll examine source code, configuration files, Docker containers, and cloud deployments to discover these secrets. Each challenge teaches you different ways secrets can be accidentally exposed in real-world applications.

📋 Prerequisites

For basic usage:

• A web browser
• Docker (for local setup) - Install here

For advanced setups:

• Kubernetes/Minikube - Install here
• Cloud account (AWS/GCP/Azure) for cloud challenges
• Command line familiarity