Challenge 54 & Challenge55 hidden secrets in gitignore and .ssh #1929
Conversation
.ssh/config
Outdated
| User wrongsecrets | ||
| Port 4444 | ||
| # Cha-llen-ge 5-5 (to avoid detection by scanning tools) | ||
| # Se-cret en-cry-pted : U2FsdGVkX18Z71msuvueMq5Tyioi7zYt6FJM/z6qJIvXM8q587ZT4ogr49ccs9Mv |
There was a problem hiding this comment.
What if we make this just an ssh pubkey instead? (Or add a pubkey as another challenge)
Because I have not seen a secret like that in real life: I did see the “why doesn’t it work let’s put both public and private key here”. So let’s make this a “the pub and private key are here by mistake” challenge.
src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge54.java
Outdated
Show resolved
Hide resolved
src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge55.java
Outdated
Show resolved
Hide resolved
Co-authored-by: Jeroen Willemsen <jeroenwillemsen2001@gmail.com>
Co-authored-by: Jeroen Willemsen <jeroenwillemsen2001@gmail.com>
src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge54.java
Outdated
Show resolved
Hide resolved
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| public static String encryptAES(String input) throws Exception { | ||
| SecretKeySpec secretKey = getKeyFromPassphrase(passphrase); | ||
| Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding"); |
Check failure
Code scanning / CodeQL
Use of a broken or risky cryptographic algorithm High
There was a problem hiding this comment.
We have to use a insecure padding to have an deterministic function. Else, the tests will always fail because we encrypt the user input and compare with the encrypted secret we already have to test if the user give the correct answer.
|
|
||
| public static String encryptAES(String input) throws Exception { | ||
| SecretKeySpec secretKey = getKeyFromPassphrase(passphrase); | ||
| Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding"); |
Check failure
Code scanning / CodeQL
Use of a broken or risky cryptographic algorithm High
There was a problem hiding this comment.
We have to use a insecure padding to have an deterministic function. Else, the tests will always fail because we encrypt the user input and compare with the encrypted secret we already have to test if the user give the correct answer.
What kind of changes does this PR include?
Description
Challenge 54 is about a hidden secret in gitignore and Challenge 55 is about a hidden secret in .ssh.
Both secrets are encrypted and in base64 format to hide them from detection engines.
You can decrypt them with openssl and the passphrase given in the Description of the challenge.
The passphrase has to be available to all users in main page of the challenges.
Relations
Closes #613
Checklist: