You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: .github/workflows/codeql-analysis.yml
+3-3
Original file line number
Diff line number
Diff line change
@@ -46,11 +46,11 @@ jobs:
46
46
# If you wish to specify custom queries, you can do so here or in a config file.
47
47
# By default, queries listed here will override any specified in a config file.
48
48
# Prefix the list here with "+" to use these queries and those in the config file.
49
-
49
+
50
50
# Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
51
51
# queries: security-extended,security-and-quality
52
52
53
-
53
+
54
54
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
55
55
# If this step fails, then you should remove it and run the build manually (see below)
56
56
- name: Autobuild
@@ -59,7 +59,7 @@ jobs:
59
59
# ℹ️ Command-line programs to run using the OS shell.
60
60
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
61
61
62
-
# If the Autobuild fails above, remove it and uncomment the following three lines.
62
+
# If the Autobuild fails above, remove it and uncomment the following three lines.
63
63
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
Make sure you have an active account at AWS for which you have configured the credentials on the system where you will execute the steps below. In this example we stored the credentials under an aws profile as `awsuser`.
21
21
@@ -55,6 +55,7 @@ Your EKS cluster should be visible in [EU-West-1](https://eu-west-1.console.aws.
55
55
Are you done playing? Please run `terraform destroy` twice to clean up.
56
56
57
57
### Test it
58
+
58
59
When you have completed the installation steps, you can do `kubectl port-forward service/wrongsecrets-balancer 3000:3000` and then go to [http://localhost:3000](http://localhost:3000).
59
60
60
61
Want to know how well your cluster is holding up? Check with
@@ -64,14 +65,30 @@ Want to know how well your cluster is holding up? Check with
64
65
kubectl top pods
65
66
```
66
67
68
+
### Configuring CTFd
69
+
70
+
You can use the [Juiceshop CTF CLI](https://github.com/juice-shop/juice-shop-ctf) to generate CTFd configuration files.
juice-shop-ctf #choose ctfd and https://wrongsecrets-ctf.herokuapp.com as domain. No trailing slash! The key is 'test', by default feel free to enable hints. We do not support snippets or links/urls to code or hints.
77
+
```
78
+
79
+
Now visit the CTFd instance and setup your CTF. If you haven't set up a load balancer/ingress, the you can use `kubectl port-forward -n ctfd $(kubectl get pods --namespace ctfd -l "app.kubernetes.io/name=ctfd,app.kubernetes.io/instance=ctfd" -o jsonpath="{.items[0].metadata.name}") 8000:8000` and go to `localhost:8000` to visit CTFd.
80
+
81
+
Then use the administrative backup function to import the zipfile you created with the juice-shop-ctf command.
82
+
Want to setup your own? You can! Watch out for people finding your key though, so secure it properly: make sure the running container with the actual ctf-key is not exposed to the audience, similar to our heroku container.
83
+
67
84
### Clean it up
68
85
69
86
When you're done:
70
87
71
88
1. Kill the port forward.
72
89
2. Run the cleanup script: `cleanup-aws-autoscaling-and-helm.sh`
73
90
3. Run `terraform destroy` to clean up the infrastructure.
74
-
1. If you've deployed the `shared-state` s3 bucket, also `cd shared-state` and `terraform destroy` there.
91
+
1. If you've deployed the `shared-state` s3 bucket, also `cd shared-state` and `terraform destroy` there.
75
92
4. Run `unset KUBECONFIG` to unset the KUBECONFIG env var.
76
93
5. Run `rm ~/.kube/wrongsecrets` to remove the kubeconfig file.
77
94
6. Run `rm terraform.tfstate*` to remove local state files.
@@ -96,6 +113,7 @@ Do the following:
96
113
Note that you might have to do some manual cleanups after that.
97
114
98
115
## Terraform documentation
116
+
99
117
The documentation below is auto-generated to give insight on what's created via Terraform.
100
118
101
119
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
@@ -120,8 +138,8 @@ The documentation below is auto-generated to give insight on what's created via
|[aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones)| data source |
145
165
|[aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity)| data source |
166
+
|[aws_iam_policy_document.assume_role_for_secret_reader](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document)| data source |
146
167
|[aws_iam_policy_document.assume_role_with_oidc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document)| data source |
147
168
|[aws_iam_policy_document.secret_manager](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document)| data source |
148
169
|[aws_iam_policy_document.user_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document)| data source |
149
170
|[aws_iam_policy_document.user_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document)| data source |
171
+
|[aws_iam_policy_document.user_secret_reader](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document)| data source |
150
172
|[http_http.ip](https://registry.terraform.io/providers/hashicorp/http/latest/docs/data-sources/http)| data source |
151
173
152
174
## Inputs
153
175
154
176
| Name | Description | Type | Default | Required |
| <aname="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name)| The EKS cluster name |`string`|`"wrongsecrets-exercise-cluster"`| no |
157
-
| <aname="input_cluster_version"></a> [cluster\_version](#input\_cluster\_version)| The EKS cluster version to use |`string`|`"1.22"`| no |
179
+
| <aname="input_cluster_version"></a> [cluster\_version](#input\_cluster\_version)| The EKS cluster version to use |`string`|`"1.23"`| no |
180
+
| <aname="input_extra_allowed_ip_ranges"></a> [extra\_allowed\_ip\_ranges](#input\_extra\_allowed\_ip\_ranges)| Allowed IP ranges in addition to creator IP |`list(string)`|`[]`| no |
158
181
| <aname="input_region"></a> [region](#input\_region)| The AWS region to use |`string`|`"eu-west-1"`| no |
Want to play OWASP WrongSecrets in a large group in CTF mode, but not go over all the hassle of setting up local copies of OWASP WrongSecrets? Here is OWASP WrongSecrets CTF Party! This is a fork of OWASP MultiJuicer, which is adapted to become a dynamic multi-tenant setup for doing a CTF together!
9
10
10
11
Note that we:
12
+
11
13
- have a [Webtop](https://docs.linuxserver.io/images/docker-webtop) integrated for each player
12
14
- have a WrongSecrets instance integrated for each player
13
15
- A working admin interface which can restart both or delete both (by deleting the full namespace)
14
16
- Do not support any progress watchdog as you will have access to it, we therefore disabled it.
15
17
- It can cleanup old & unused namespaces automatically.
16
18
17
19
## Special thanks
20
+
18
21
Special thanks to [@madhuakula](https://github.com/madhuakula), [@bendehaan](https://github.com/bendehaan) , and [@mikewoudenberg](https://github.com/mikewoudenberg) for making this port a reality!
19
22
20
23
### Sponsorships
@@ -37,18 +40,20 @@ We would like to thank the following parties for helping us out:
37
40
38
41
[1Password](https://github.com/1Password/1password-teams-open-source/pull/552) for granting us an open source license to 1Password for the secret detection testbed.
39
42
40
-
41
43
## What you need to know
44
+
42
45
This environment uses a webtop and an instance of wrongsecrets per user. This means that you need per user:
46
+
43
47
- 2.5 CPU (min = 0.5 , limit = 2.5)
44
48
- 3.5 GB RAM (min 1 GB, limit = 3.5GB)
45
49
- 8GB HD (min 3 GB, limit = 8GB)
46
50
47
-
48
51
### Running this on minikube
52
+
49
53
A 3-6 contestant game can be played on a local minikube with updated cpu & memory settings (e.g. 6 virtual CPUs, 9 GB ram).
50
54
51
55
### Running this on AWS EKS with larger groups
56
+
52
57
A 100 contestant game can be played on the AWS setup, which will require around 200 (100-250) CPUs, 300 (250-350) GB Ram, and 800 GB of storage available in the cluster. Note that we have configured everything based on autoscaling in AWS. This means that you can often start with a cluster about 20% of the size of the "limit" numbers and then see how things evolve. You will hardly hit those limits, unless all players are very actively fuzzing the WrongSecrets app, while runnign heavy appss on their Webtops. Instead, you will see that you are using just 25% of what is provided in numbers here. So, by using our terraform (including an autoscaling managed nodegroup), you can reduce the cost of your CTF by a lot!
53
58
54
59
## Status - Experimental release
@@ -62,26 +67,28 @@ The different setups are explained in [OWASP WrongSecrets CTF-instructions](http
62
67
### Approach 1: 3-domain setup
63
68
64
69
You need 3 things:
70
+
65
71
- This infrastructure
66
72
- The actual place where correct answers are exchanged for CTFD-flags. This can be your fly.dev/heroku/etc. or local container of WrongSecrets running in CTF mode with the additional key setup for challenge 8.
67
73
- A CTFD/Facebook-CTF host which is populated with the challenges based on your secondary hosted WrongSecrets application.
68
74
69
75
### Approach 2: 2-domain setup
70
76
71
77
You need 2 things:
72
-
- This infrastructure
73
-
- A CTFD/Facebook-CTF host which is populated with the challenges based on your secondary hosted WrongSecrets application.
74
78
79
+
- This infrastructure
80
+
- A CTFD/Facebook-CTF host which is populated with the challenges based on your secondary hosted WrongSecrets application (this can be the helm chart included in the EKS installation script)
75
81
76
82
### General Helm usage
77
83
78
84
This setup works best if you have Calico installed as your CNI, if you want to use the helm directly, without the AWS Challenges, do:
Want to know whether your system is holding up? use
100
108
101
109
```shell
@@ -108,11 +116,10 @@ kubectl top pods
108
116
109
117
** NOTE: SEE SECTIONS ABOVE ABOUT WHAT YOU NEED AND THE COST OF THINGS: This project is not responsible, and will not pay for any part of your AWS bill. **
110
118
111
-
For AWS EKS follow the instrucrtions in the `/aws` folder.
119
+
For AWS EKS follow the instructions in the `/aws` folder. This setup also includes a helm installation of CTFd.
112
120
113
121
Then open a browser and go to [localhost:3000](http:localhost:3000) and have fun :D .
114
122
115
-
116
123
### Some production notes
117
124
118
125
See [production notes](./guides/production-notes/production-notes.md) for a checklist of values you'll likely need to configure before using Wrongsecrets-ctf-party in proper events.
@@ -122,6 +129,8 @@ See [production notes](./guides/production-notes/production-notes.md) for a chec
122
129
You got some options on how to setup the stack, with some option to customize the WrongSecrets and Virtual desktop instances to your own liking.
123
130
You can find the default config values under: [helm/wrongsecrets-ctf-party/values.yaml](helm/wrongsecrets-ctf-party/values.yaml)
124
131
132
+
The default ctfd config values are here: [aws/k8s/ctfd-values.yaml](aws/k8s/ctfd-values.yaml). Note that these values are not used, and instead only se in the file [aws/build-an-deploy-aws.sh](aws/build-an-deploy-aws.sh).
133
+
125
134
Download & Save the file and tell helm to use your config file over the default by running:
There are a few more ways how you can check whether all is going well: have a look in the [/scripts](/scripts/) folder for various tools that can help you to see if there are too many namespaces created for instance. This does require you to export the teams and players from ctfd.
167
182
168
-
169
183
### Did somebody actually ask any of these questions?
0 commit comments