From 6ef9109cb50fe2eb64367efe86203a8c86bff266 Mon Sep 17 00:00:00 2001 From: Jeroen Willemsen Date: Sat, 5 Sep 2026 06:41:22 +0200 Subject: [PATCH 1/3] Adding challenge 67 with shared chatgpt session --- chatgpt_dump.html | 11 ++++++ .../challenges/docker/Challenge67.java | 38 +++++++++++++++++++ .../resources/explanations/challenge67.adoc | 5 +++ .../explanations/challenge67_hint.adoc | 1 + .../explanations/challenge67_reason.adoc | 8 ++++ .../wrong-secrets-configuration.yaml | 13 +++++++ .../challenges/docker/Challenge67Test.java | 30 +++++++++++++++ 7 files changed, 106 insertions(+) create mode 100644 chatgpt_dump.html create mode 100644 src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge67.java create mode 100644 src/main/resources/explanations/challenge67.adoc create mode 100644 src/main/resources/explanations/challenge67_hint.adoc create mode 100644 src/main/resources/explanations/challenge67_reason.adoc create mode 100644 src/test/java/org/owasp/wrongsecrets/challenges/docker/Challenge67Test.java diff --git a/chatgpt_dump.html b/chatgpt_dump.html new file mode 100644 index 0000000000..c61338f130 --- /dev/null +++ b/chatgpt_dump.html @@ -0,0 +1,11 @@ +ChatGPT - Generate Password
diff --git a/src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge67.java b/src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge67.java new file mode 100644 index 0000000000..b81ecf8571 --- /dev/null +++ b/src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge67.java @@ -0,0 +1,38 @@ +package org.owasp.wrongsecrets.challenges.docker; + +import static org.owasp.wrongsecrets.Challenges.ErrorResponses.DECRYPTION_ERROR; + +import java.nio.charset.StandardCharsets; +import java.util.Base64; +import javax.crypto.Cipher; +import javax.crypto.spec.IvParameterSpec; +import javax.crypto.spec.SecretKeySpec; +import lombok.extern.slf4j.Slf4j; +import org.owasp.wrongsecrets.challenges.FixedAnswerChallenge; +import org.springframework.stereotype.Component; + +/** This challenge is about finding a secret shared in a ChatGPT chat link. */ +@Slf4j +@Component +public class Challenge67 extends FixedAnswerChallenge { + + private static final String CIPHERTEXT = "dagGnT4fdF7/z010sAHhhp1t6w2NsUQkHy9+Fx1LCG0="; + + @Override + public String getAnswer() { + try { + byte[] keyBytes = "SuperSecretKey12".getBytes(StandardCharsets.UTF_8); + byte[] ivBytes = "InitVector123456".getBytes(StandardCharsets.UTF_8); + byte[] cipherBytes = Base64.getDecoder().decode(CIPHERTEXT); + SecretKeySpec keySpec = new SecretKeySpec(keyBytes, "AES"); + IvParameterSpec ivSpec = new IvParameterSpec(ivBytes); + Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding"); + cipher.init(Cipher.DECRYPT_MODE, keySpec, ivSpec); + byte[] decrypted = cipher.doFinal(cipherBytes); + return new String(decrypted, StandardCharsets.UTF_8).trim(); + } catch (Exception e) { + log.error("Decryption failed", e); + return DECRYPTION_ERROR; + } + } +} diff --git a/src/main/resources/explanations/challenge67.adoc b/src/main/resources/explanations/challenge67.adoc new file mode 100644 index 0000000000..337e88f2a7 --- /dev/null +++ b/src/main/resources/explanations/challenge67.adoc @@ -0,0 +1,5 @@ +=== AI Chat Secret Leak + +Sharing chat sessions from AI tools like ChatGPT can be a great way to collaborate, but it's easy to forget that these shared links are public. If the chat contains sensitive information, anyone with the link can see it. + +Can you find the secret in this https://chatgpt.com/share/6a99237a-c2e0-83eb-9a09-a1cf76213ff5[shared ChatGPT session]? diff --git a/src/main/resources/explanations/challenge67_hint.adoc b/src/main/resources/explanations/challenge67_hint.adoc new file mode 100644 index 0000000000..8c20a4d86b --- /dev/null +++ b/src/main/resources/explanations/challenge67_hint.adoc @@ -0,0 +1 @@ +Follow the link to the shared ChatGPT session and look for a generated password. diff --git a/src/main/resources/explanations/challenge67_reason.adoc b/src/main/resources/explanations/challenge67_reason.adoc new file mode 100644 index 0000000000..fa0b852341 --- /dev/null +++ b/src/main/resources/explanations/challenge67_reason.adoc @@ -0,0 +1,8 @@ +=== Why sharing AI chats with secrets is dangerous + +AI models are often used to generate code, configuration, or even credentials. When a user shares a chat session, they are creating a public URL that anyone can access. If the session contains API keys, passwords, or proprietary logic, those secrets are now exposed. + +It is important to: +- Never provide real secrets to AI tools. +- Scrub any sensitive information from chats before sharing them. +- Use enterprise versions of AI tools that offer better data protection and sharing controls. diff --git a/src/main/resources/wrong-secrets-configuration.yaml b/src/main/resources/wrong-secrets-configuration.yaml index 6871933e11..89c5e0a7a3 100644 --- a/src/main/resources/wrong-secrets-configuration.yaml +++ b/src/main/resources/wrong-secrets-configuration.yaml @@ -1013,3 +1013,16 @@ configurations: category: *bin ctf: enabled: true + + - name: Challenge 67 + short-name: "challenge-67" + sources: + - class-name: "org.owasp.wrongsecrets.challenges.docker.Challenge67" + explanation: "explanations/challenge67.adoc" + hint: "explanations/challenge67_hint.adoc" + reason: "explanations/challenge67_reason.adoc" + environments: *all_envs + difficulty: *easy + category: *ai + ctf: + enabled: true diff --git a/src/test/java/org/owasp/wrongsecrets/challenges/docker/Challenge67Test.java b/src/test/java/org/owasp/wrongsecrets/challenges/docker/Challenge67Test.java new file mode 100644 index 0000000000..db6198dd19 --- /dev/null +++ b/src/test/java/org/owasp/wrongsecrets/challenges/docker/Challenge67Test.java @@ -0,0 +1,30 @@ +package org.owasp.wrongsecrets.challenges.docker; + +import static org.assertj.core.api.Assertions.assertThat; + +import org.junit.jupiter.api.Test; +import org.owasp.wrongsecrets.challenges.Spoiler; + +class Challenge67Test { + + @Test + void spoilerShouldRevealAnswer() { + var challenge = new Challenge67(); + + assertThat(challenge.spoiler()).isEqualTo(new Spoiler("Q7v!mR2#xL9@pT6$wN4&kZ8^cF3*Hs5")); + } + + @Test + void rightAnswerShouldSolveChallenge() { + var challenge = new Challenge67(); + + assertThat(challenge.answerCorrect("Q7v!mR2#xL9@pT6$wN4&kZ8^cF3*Hs5")).isTrue(); + } + + @Test + void incorrectAnswerShouldNotSolveChallenge() { + var challenge = new Challenge67(); + + assertThat(challenge.answerCorrect("wrong answer")).isFalse(); + } +} From 3249289354e353f6ddf1ec932668a2b0b28b7d24 Mon Sep 17 00:00:00 2001 From: Jeroen Willemsen Date: Sat, 5 Sep 2026 06:43:55 +0200 Subject: [PATCH 2/3] adding hcallenge 68 instead of 67 --- .../docker/{Challenge67.java => Challenge68.java} | 2 +- .../{challenge67.adoc => challenge68.adoc} | 0 .../{challenge67_hint.adoc => challenge68_hint.adoc} | 0 ...allenge67_reason.adoc => challenge68_reason.adoc} | 0 src/main/resources/wrong-secrets-configuration.yaml | 12 ++++++------ .../{Challenge67Test.java => Challenge68Test.java} | 8 ++++---- 6 files changed, 11 insertions(+), 11 deletions(-) rename src/main/java/org/owasp/wrongsecrets/challenges/docker/{Challenge67.java => Challenge68.java} (96%) rename src/main/resources/explanations/{challenge67.adoc => challenge68.adoc} (100%) rename src/main/resources/explanations/{challenge67_hint.adoc => challenge68_hint.adoc} (100%) rename src/main/resources/explanations/{challenge67_reason.adoc => challenge68_reason.adoc} (100%) rename src/test/java/org/owasp/wrongsecrets/challenges/docker/{Challenge67Test.java => Challenge68Test.java} (81%) diff --git a/src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge67.java b/src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge68.java similarity index 96% rename from src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge67.java rename to src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge68.java index b81ecf8571..8071a5cb13 100644 --- a/src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge67.java +++ b/src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge68.java @@ -14,7 +14,7 @@ /** This challenge is about finding a secret shared in a ChatGPT chat link. */ @Slf4j @Component -public class Challenge67 extends FixedAnswerChallenge { +public class Challenge68 extends FixedAnswerChallenge { private static final String CIPHERTEXT = "dagGnT4fdF7/z010sAHhhp1t6w2NsUQkHy9+Fx1LCG0="; diff --git a/src/main/resources/explanations/challenge67.adoc b/src/main/resources/explanations/challenge68.adoc similarity index 100% rename from src/main/resources/explanations/challenge67.adoc rename to src/main/resources/explanations/challenge68.adoc diff --git a/src/main/resources/explanations/challenge67_hint.adoc b/src/main/resources/explanations/challenge68_hint.adoc similarity index 100% rename from src/main/resources/explanations/challenge67_hint.adoc rename to src/main/resources/explanations/challenge68_hint.adoc diff --git a/src/main/resources/explanations/challenge67_reason.adoc b/src/main/resources/explanations/challenge68_reason.adoc similarity index 100% rename from src/main/resources/explanations/challenge67_reason.adoc rename to src/main/resources/explanations/challenge68_reason.adoc diff --git a/src/main/resources/wrong-secrets-configuration.yaml b/src/main/resources/wrong-secrets-configuration.yaml index 89c5e0a7a3..c74d5f8d52 100644 --- a/src/main/resources/wrong-secrets-configuration.yaml +++ b/src/main/resources/wrong-secrets-configuration.yaml @@ -1014,13 +1014,13 @@ configurations: ctf: enabled: true - - name: Challenge 67 - short-name: "challenge-67" + - name: Challenge 68 + short-name: "challenge-68" sources: - - class-name: "org.owasp.wrongsecrets.challenges.docker.Challenge67" - explanation: "explanations/challenge67.adoc" - hint: "explanations/challenge67_hint.adoc" - reason: "explanations/challenge67_reason.adoc" + - class-name: "org.owasp.wrongsecrets.challenges.docker.Challenge68" + explanation: "explanations/challenge68.adoc" + hint: "explanations/challenge68_hint.adoc" + reason: "explanations/challenge68_reason.adoc" environments: *all_envs difficulty: *easy category: *ai diff --git a/src/test/java/org/owasp/wrongsecrets/challenges/docker/Challenge67Test.java b/src/test/java/org/owasp/wrongsecrets/challenges/docker/Challenge68Test.java similarity index 81% rename from src/test/java/org/owasp/wrongsecrets/challenges/docker/Challenge67Test.java rename to src/test/java/org/owasp/wrongsecrets/challenges/docker/Challenge68Test.java index db6198dd19..6326946bcb 100644 --- a/src/test/java/org/owasp/wrongsecrets/challenges/docker/Challenge67Test.java +++ b/src/test/java/org/owasp/wrongsecrets/challenges/docker/Challenge68Test.java @@ -5,25 +5,25 @@ import org.junit.jupiter.api.Test; import org.owasp.wrongsecrets.challenges.Spoiler; -class Challenge67Test { +class Challenge68Test { @Test void spoilerShouldRevealAnswer() { - var challenge = new Challenge67(); + var challenge = new Challenge68(); assertThat(challenge.spoiler()).isEqualTo(new Spoiler("Q7v!mR2#xL9@pT6$wN4&kZ8^cF3*Hs5")); } @Test void rightAnswerShouldSolveChallenge() { - var challenge = new Challenge67(); + var challenge = new Challenge68(); assertThat(challenge.answerCorrect("Q7v!mR2#xL9@pT6$wN4&kZ8^cF3*Hs5")).isTrue(); } @Test void incorrectAnswerShouldNotSolveChallenge() { - var challenge = new Challenge67(); + var challenge = new Challenge68(); assertThat(challenge.answerCorrect("wrong answer")).isFalse(); } From 49d8fb9a2665499a12881412161ece1659605792 Mon Sep 17 00:00:00 2001 From: Jeroen Willemsen Date: Sat, 5 Sep 2026 06:53:18 +0200 Subject: [PATCH 3/3] update tips --- .../wrongsecrets/challenges/ChallengeUI.java | 29 +++++++++++++++++++ src/main/resources/templates/challenge.html | 2 +- .../wrong-secrets-configuration.yaml | 2 +- 3 files changed, 31 insertions(+), 2 deletions(-) diff --git a/src/main/java/org/owasp/wrongsecrets/challenges/ChallengeUI.java b/src/main/java/org/owasp/wrongsecrets/challenges/ChallengeUI.java index e5e23e933d..a4dfab283c 100644 --- a/src/main/java/org/owasp/wrongsecrets/challenges/ChallengeUI.java +++ b/src/main/java/org/owasp/wrongsecrets/challenges/ChallengeUI.java @@ -86,6 +86,35 @@ public String getTech() { return challengeDefinition.category().category(); } + /** + * Returns an optimized "Look for" hint based on the challenge technology. + * + * @return string with the optimized hint. + */ + public String getLookForHint() { + return switch (getTech()) { + case "Intro" -> "Configuration files, source code, or documentation."; + case "Git" -> "Commit history, branches, or git configuration."; + case "Docker" -> "Dockerfiles, docker-compose files, or container environment variables."; + case "Configmaps", "Secrets", "Vault", "CSI-Driver" -> + "Kubernetes manifests, ConfigMaps, Secrets, or Vault configurations."; + case "Terraform", "IAM privilege escalation" -> + "Cloud infrastructure settings, Terraform files, or IAM policies."; + case "Logging" -> "Application logs or system output."; + case "CI/CD" -> "Pipeline configurations or build scripts."; + case "Password Manager" -> "Password manager entries or credentials."; + case "Cryptography" -> "Cryptographic keys, algorithms, or encoded strings."; + case "Binary" -> "Binary files, decompiled code, or executable strings."; + case "Front-end" -> "JavaScript code, HTML source, or browser storage."; + case "Web3" -> "Smart contracts or blockchain transactions."; + case "Documentation" -> "Project documentation or comments."; + case "AI" -> "AI prompts, model configurations, or chat history."; + default -> + "Configuration files, source code, environment variables, Docker files, or cloud" + + " infrastructure related to this challenge."; + }; + } + /** * Returns the number of the next challenge (e.g current+1). * diff --git a/src/main/resources/templates/challenge.html b/src/main/resources/templates/challenge.html index 5561fb0471..7d325a4ed0 100644 --- a/src/main/resources/templates/challenge.html +++ b/src/main/resources/templates/challenge.html @@ -12,7 +12,7 @@
diff --git a/src/main/resources/wrong-secrets-configuration.yaml b/src/main/resources/wrong-secrets-configuration.yaml index c74d5f8d52..cf1f17a182 100644 --- a/src/main/resources/wrong-secrets-configuration.yaml +++ b/src/main/resources/wrong-secrets-configuration.yaml @@ -944,7 +944,7 @@ configurations: reason: "explanations/challenge61_reason.adoc" environments: *all_envs difficulty: *normal - category: *secrets + category: *git ctf: enabled: true