An OWASP training app with 62 challenges demonstrating real-world secrets management mistakes and how to find them.
OWASP WrongSecrets is an open-source training application that demonstrates 62 common ways secrets can be accidentally exposed in software. It provides hands-on challenges where users must find intentionally hidden secrets using various security tools and techniques. The project helps developers and security teams recognize vulnerabilities in their own secrets management practices.
Security engineers, DevOps practitioners, and developers who want to improve their understanding of secrets management vulnerabilities and learn practical detection techniques. It's also valuable for teams running security training workshops or Capture The Flag (CTF) events.
Unlike theoretical guides, WrongSecrets offers practical, hands-on challenges across multiple environments (Docker, Kubernetes, cloud platforms). It's maintained under OWASP with real-world scenarios and serves as both a training tool and a benchmark for secret detection tools.
Vulnerable app with examples showing how to not use secrets
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
With 62 challenges spanning Docker, Kubernetes, and multiple cloud providers, it offers extensive, real-world examples of secrets exposure, as highlighted in the README's detailed deployment options.
Supports CTF platforms like CTFd and FBCTF, making it easy to organize workshops and competitions, with integrations documented for seamless setup.
Can be forked and modified to disable specific challenges or adapt for internal training, as noted in the 'Want to disable challenges' section of the README.
As an OWASP production project with sponsorships from GitGuardian and JetBrains, it receives regular updates and community contributions, ensuring relevance.
Cloud challenges require setting up AWS, GCP, or Azure accounts with specific IAM roles, and the README explicitly warns against using production environments due to privilege escalation risks.
Some deployments, such as on Render.io or using development containers, are marked as experimental or may be unstable, with warnings about potential issues in the README.
While basic setup is covered, advanced configurations like customizing CTF integrations or modifying challenges require navigating multiple scripts and files, which can be daunting.