Update POM file with new version: 1.4.6

Author: commjoen

.github/scripts/docker-create-and-push.sh

@@ -87,9 +87,9 @@ git restore src/main/resources/.bash_history
 echo "committing changes and new pom file with version ${tag}"
 git commit -am "Update POM file with new version: ${tag}"
 git push
-#echo "tagging version"
-#git tag -a $tag -m "${message}"
-#git push --tags
+echo "tagging version"
+git tag -a $tag -m "${message}"
+git push --tags
 
 echo "Don't forget to update experiment-bed"
 echo "git checkout experiment-bed && git merge master --no-edit"

Dockerfile.web

@@ -1,6 +1,6 @@
-FROM jeroenwillemsen/wrongsecrets:challenge21test5-no-vault
+FROM jeroenwillemsen/wrongsecrets:1.4.6-no-vault
 
-ARG argBasedVersion="1.4.5"
+ARG argBasedVersion="1.4.6"
 ARG CANARY_URLS="http://canarytokens.com/terms/about/s7cfbdakys13246ewd8ivuvku/post.jsp,http://canarytokens.com/terms/about/y0all60b627gzp19ahqh7rl6j/post.jsp"
 ENV APP_VERSION=$argBasedVersion
 ENV K8S_ENV=Heroku(Docker)

README.md

@@ -6,7 +6,7 @@
 
 Welcome to the OWASP WrongSecrets p0wnable app. With this app, we have packed various ways of how to not store your secrets. These can help you to realize whether your secret management is ok. The challenge is to find all the different secrets by means of various tools and techniques.
 
-Can you solve all the 20 challenges?
+Can you solve all the 21 challenges?
 ![screenshot.png](screenshot.png)
 
 ## Support
@@ -15,7 +15,7 @@ Need support? Contact us via [OWASP Slack](https://owasp.slack.com/archives/C02K
 
 ## Basic docker exercises
 
-_Can be used for challenges 1-4, 8, 12-20_
+_Can be used for challenges 1-4, 8, 12-21_
 
 For the basic docker exercises you currently require:
 
@@ -25,7 +25,7 @@ For the basic docker exercises you currently require:
 You can install it by doing:
 
 ```bash
-docker run -p 8080:8080 jeroenwillemsen/wrongsecrets:1.4.5-no-vault
+docker run -p 8080:8080 jeroenwillemsen/wrongsecrets:1.4.6-no-vault
 ```
 
 Now you can try to find the secrets by means of solving the challenge offered at:
@@ -44,6 +44,7 @@ Now you can try to find the secrets by means of solving the challenge offered at
 - [localhost:8080/challenge/18](http://localhost:8080/challenge/18)
 - [localhost:8080/challenge/19](http://localhost:8080/challenge/19)
 - [localhost:8080/challenge/20](http://localhost:8080/challenge/20)
+- [localhost:8080/challenge/21](http://localhost:8080/challenge/21)
 
 Note that these challenges are still very basic, and so are their explanations. Feel free to file a PR to make them look better ;-).
 
@@ -60,7 +61,7 @@ You can test them out at [https://wrongsecrets.herokuapp.com/](https://wrongsecr
 
 ## Basic K8s exercise
 
-_Can be used for challenges 1-6, 8, 12-19_
+_Can be used for challenges 1-6, 8, 12-21_
 
 ### Minikube based
 
@@ -107,7 +108,7 @@ now you can use the provided IP address and port to further play with the K8s va
 
 ## Vault exercises with minikube
 
-_Can be used for challenges 1-8, 12-19_
+_Can be used for challenges 1-8, 12-21_
 Make sure you have the following installed:
 
 - minikube with docker (or comment out line 8 and work at your own k8s setup),
@@ -118,13 +119,13 @@ Make sure you have the following installed:
 - vault [Install from here](https://www.vaultproject.io/downloads),
 - grep, Cat, and Sed
 
-Run `./k8s-vault-minkube-start.sh`, when the script is done, then the challenges will wait for you at <http://localhost:8080> . This will allow you to run challenges 1-8, 12-20.
+Run `./k8s-vault-minkube-start.sh`, when the script is done, then the challenges will wait for you at <http://localhost:8080> . This will allow you to run challenges 1-8, 12-21.
 
 When you stopped the `k8s-vault-minikube-start.sh` script and want to resume the port forward run: `k8s-vault-minikube-resume.sh`. This is because if you run the start script again it will replace the secret in the vault and not update the secret-challenge application with the new secret.
 
 ## Cloud Challenges
 
-_Can be used for challenges 1-20_
+_Can be used for challenges 1-21_
 
 **READ THIS**: Given that the exercises below contain IAM privilege escalation exercises, 
 never run this on an account which is related to your production environment or can influence your account-over-arching resources.

aws/k8s/secret-challenge-vault-deployment.yml

@@ -37,7 +37,7 @@ spec:
             volumeAttributes:
               secretProviderClass: "wrongsecrets-aws-secretsmanager"
       containers:
-        - image: jeroenwillemsen/wrongsecrets:challenge21test5-k8s-vault
+        - image: jeroenwillemsen/wrongsecrets:1.4.6-k8s-vault
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

azure/k8s/secret-challenge-vault-deployment.yml.tpl

@@ -35,7 +35,7 @@ spec:
             volumeAttributes:
               secretProviderClass: "azure-wrongsecrets-vault"
       containers:
-        - image: jeroenwillemsen/wrongsecrets:challenge21test5-k8s-vault
+        - image: jeroenwillemsen/wrongsecrets:1.4.6-k8s-vault
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

gcp/k8s/secret-challenge-vault-deployment.yml.tpl

@@ -37,7 +37,7 @@ spec:
             volumeAttributes:
               secretProviderClass: "wrongsecrets-gcp-secretsmanager"
       containers:
-        - image: jeroenwillemsen/wrongsecrets:challenge21test5-k8s-vault
+        - image: jeroenwillemsen/wrongsecrets:1.4.6-k8s-vault
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

k8s/secret-challenge-deployment.yml

@@ -28,7 +28,7 @@ spec:
         runAsGroup: 2000
         fsGroup: 2000
       containers:
-        - image: jeroenwillemsen/wrongsecrets:challenge21test5-no-vault
+        - image: jeroenwillemsen/wrongsecrets:1.4.6-no-vault
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

k8s/secret-challenge-vault-deployment.yml

@@ -30,7 +30,7 @@ spec:
         runAsNonRoot: true
       serviceAccountName: vault
       containers:
-        - image: jeroenwillemsen/wrongsecrets:challenge21test5-k8s-vault
+        - image: jeroenwillemsen/wrongsecrets:1.4.6-k8s-vault
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

pom.xml

@@ -9,7 +9,7 @@
     </parent>
     <groupId>org.owasp</groupId>
     <artifactId>wrongsecrets</artifactId>
-    <version>challenge21test5-SNAPSHOT</version>
+    <version>1.4.6-SNAPSHOT</version>
     <name>OWASP WrongSecrets</name>
     <description>Examples with how to not use secrets</description>
     <url>https://owasp.org/www-project-wrongsecrets/</url>