add missing challenge references
Welcome to the OWASP WrongSecrets p0wnable app. With this app, we have packed various ways of how to not store your secrets. These can help you to realize whether your secret management is ok. The challenge is to find all the different secrets by means of various tools and techniques.
-Can you solve all the 16 challenges?
+Can you solve all the 17 challenges?
![screenshot.png](screenshot.png)
## Support
@@ -15,7 +15,7 @@ Need support? Contact us via [OWASP Slack](https://owasp.slack.com/archives/C02K
## Basic docker exercises
-_Can be used for challenges 1-4, 8, 12-15_
+_Can be used for challenges 1-4, 8, 12-17_
For the basic docker exercises you currently require:
@@ -40,6 +40,7 @@ Now you can try to find the secrets by means of solving the challenge offered at
- [localhost:8080/challenge/14](http://localhost:8080/challenge/14)
- [localhost:8080/challenge/15](http://localhost:8080/challenge/15)
- [localhost:8080/challenge/16](http://localhost:8080/challenge/16)
+- [localhost:8080/challenge/17](http://localhost:8080/challenge/17)
Note that these challenges are still very basic, and so are their explanations. Feel free to file a PR to make them look better ;-).
@@ -56,7 +57,7 @@ You can test them out at [https://wrongsecrets.herokuapp.com/](https://wrongsecr
## Basic K8s exercise
-_Can be used for challenges 1-6, 8, 12-16_
+_Can be used for challenges 1-6, 8, 12-17_
### Minikube based
@@ -103,7 +104,7 @@ now you can use the provided IP address and port to further play with the K8s va
## Vault exercises with minikube
-_Can be used for challenges 1-8, 12-16_
+_Can be used for challenges 1-8, 12-17_
Make sure you have the following installed:
- minikube with docker (or comment out line 8 and work at your own k8s setup),
@@ -114,13 +115,13 @@ Make sure you have the following installed:
- vault [Install from here](https://www.vaultproject.io/downloads),
- grep, Cat, and Sed
-Run `./k8s-vault-minkube-start.sh`, when the script is done, then the challenges will wait for you at <http://localhost:8080> . This will allow you to run challenges 1-8, 12-15.
+Run `./k8s-vault-minkube-start.sh`, when the script is done, then the challenges will wait for you at <http://localhost:8080> . This will allow you to run challenges 1-8, 12-17.
When you stopped the `k8s-vault-minikube-start.sh` script and want to resume the port forward run: `k8s-vault-minikube-resume.sh`. This is because if you run the start script again it will replace the secret in the vault and not update the secret-challenge application with the new secret.
## Cloud Challenges
-_Can be used for challenges 1-16_
+_Can be used for challenges 1-17_
**READ THIS**: Given that the exercises below contain IAM privilege escalation exercises,
never run this on an account which is related to your production environment or can influence your account-over-arching resources.
