OWASP/wrongsecrets

Have a challenge with a backup bucket containing the secret

开放

#982 创建于 2023年9月9日

 (15 条评论) (0 个反应) (1 位负责人)Java (601 个派生)github user discovery
New Challengehelp wanted

仓库指标

星标
 (1,457 个星标)
PR 合并指标
 (平均合并 4天 1小时) (30 天内合并 29 个 PR)

描述

Context

  • What should the challenge scenario be like? Have a backup s3/storage bucket with a private ed25519 key publicly exposed
  • What should the participant learn from completing the challenge? Secure your backup at all cost
  • For what category would the challenge be? (e.g. Docker, K8s, binary) Docker/cloud depending on how we implement the backup solution

Actions:

  • create separate Terraform folder to have an S3 bucket (in our AWS folder) under the name "backupchallenge"
  • have the key copying logic in a shell script using AWS CLI as part of the backupchallenge folder
  • implement the challenge according to contributing.md and make sure you hide the key in your classfile.

贡献者指南