Conversation
…d BinaryExecutionHelper LD_LIBRARY_PATH support Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com> Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/943e2996-a1c1-4ad7-a536-60fedf93589c
…er test for Challenge63 Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com> Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/943e2996-a1c1-4ad7-a536-60fedf93589c
|
🌐 GitHub Pages Preview Ready! Your static preview is now available at: 📄 What's included:
For full functionality testing: Use the Docker preview instead. 🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR. Static preview with Thymeleaf generation by GitHub Actions |
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-d3aefaf
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-d3aefafThen visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
@copilot can you fix the failing github actions please? |
…HS array Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com> Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/6c02591b-e955-441e-9735-6759d336f157
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2470 |
|
🌐 GitHub Pages Preview Ready! Your static preview is now available at: 📄 What's included:
For full functionality testing: Use the Docker preview instead. 🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR. Static preview with Thymeleaf generation by GitHub Actions |
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-f8d3491
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-f8d3491Then visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2470 |
|
java.io.IOException: Cannot run program "/tmp/c-exec-wrongsecrets-swift-linux-musl-arm7674393112878681325sh": Exec failed, error: 2 (No such file or directory) |
|
@copilot i see the following error when running the container locally: java.io.IOException: Cannot run program "/tmp/c-exec-wrongsecrets-swift-linux-musl-arm7674393112878681325sh": Exec failed, error: 2 (No such file or directory) |
|
🌐 GitHub Pages Preview Ready! Your static preview is now available at: 📄 What's included:
For full functionality testing: Use the Docker preview instead. 🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR. Static preview with Thymeleaf generation by GitHub Actions |
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-1abe86e
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-1abe86eThen visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2470 |
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-0d11d06
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-0d11d06Then visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2470 |
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-e513e93
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-e513e93Then visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2470 |
|
@copilot can you further reduce the jar size for container creation in the shell script (wrongsecrets/.github/scripts/docker-create.sh) by removing all non-necessary binaries? it should already have a list of bianries it is removing, but we can extand it with any other non-musl binary i think. |
…ies from JAR The existing removal list only covered dotnet and macOS golang variants. Extend it to also remove: - All other macOS binaries (c, advanced-c, cplus, challenge52, challenge53, rust, swift) - All Linux glibc (non-musl) binaries for the same set plus swift CTF variants - Swift macOS and Linux CTF variants Kept in JAR (intentionally): - wrongsecrets-golang-linux / -linux-arm: golang skips -musl suffix in BinaryExecutionHelper so the glibc linux binary is used even on Alpine - wrongsecrets-*-linux-musl*: all musl variants are needed on Alpine Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/e499629b-1a09-470a-aec9-c0cd8ec3faec Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>
Done in d67233d. Extended the removal list from 7 entries to 41 entries, organized into three groups: macOS / non-Linux binaries (new): c, advanced-c (including stripped variants), cplus, challenge52-c, challenge53-c, rust, swift (including CTF variants), plus the existing golang and dotnet entries Linux glibc (non-musl) binaries (new): same set for all binary families — c, advanced-c, cplus, challenge52-c, challenge53-c, rust, swift (including CTF variants), plus the existing dotnet entries Windows .exe (unchanged) Intentionally kept in the JAR: |
|
🌐 GitHub Pages Preview Ready! Your static preview is now available at: 📄 What's included:
For full functionality testing: Use the Docker preview instead. 🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR. Static preview with Thymeleaf generation by GitHub Actions |
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-d60457f
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-d60457fThen visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2470 |
|
@copilot for golang too many binaries were stripped, we see: |
On Alpine/ARM64 (aarch64), BinaryExecutionHelper builds the filename 'wrongsecrets-golang-linux-arm' (golang intentionally skips the -musl suffix). The Dockerfile was only copying wrongsecrets-golang-linux (x86), so ARM64 containers fell back to /home/wrongsecrets/ and failed with FileNotFoundException when golang challenges were opened. Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/c5ecdba6-1339-40b5-9a59-3c3788134134 Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>
Fixed in 828fe76. The root cause was in the Dockerfile, not |
|
🌐 GitHub Pages Preview Ready! Your static preview is now available at: 📄 What's included:
For full functionality testing: Use the Docker preview instead. 🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR. Static preview with Thymeleaf generation by GitHub Actions |
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-6dfaf7d
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-6dfaf7dThen visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2470 |
|
🌐 GitHub Pages Preview Ready! Your static preview is now available at: 📄 What's included:
For full functionality testing: Use the Docker preview instead. 🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR. Static preview with Thymeleaf generation by GitHub Actions |
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-569a3f3
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2470-569a3f3Then visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2470 |
|
@copilot I just got : |
Implements the Swift binary reverse engineering challenge, teaching users that hardcoded secrets in Swift binaries are recoverable via tools like Ghidra or radare2.
Changes
New challenge
Challenge63.java— runswrongsecrets-swiftbinary to retrieve the answer; follows the sameFixedAnswerChallenge+BinaryExecutionHelperpattern as C/C++/Rust/Go challengesChallenge63Test.java— tests correct spoiler output and incorrect answer rejectionwrong-secrets-configuration.yaml— registers Challenge 63 (category:bin, difficulty:master, CTF-enabled)Swift binaries
Downloaded from
wrongsecrets-binariesintosrc/main/resources/executables/:wrongsecrets-swift/-arm(macOS)wrongsecrets-swift-linux/-linux-arm/-linux-musl/-linux-musl-armThe
linux-muslvariants are fully statically linked (~42 MB each), embedding the entire Swift runtime. This makes them self-contained on any musl-based system (e.g. Alpine) without requiring external shared libraries.Swift runtime library support
The non-musl Linux Swift binary dynamically links
libswiftCore.so, which isn't in the defaultldsearch path in all environments.BinaryExecutionHelpernow auto-detects installed Swift runtime paths and injectsLD_LIBRARY_PATHbefore executing anyswift-named binary:Docker container support
The wrongsecrets Docker container uses Alpine Linux (musl libc). On Alpine,
BinaryExecutionHelperautomatically selects thewrongsecrets-swift-linux-muslvariant. Because those binaries are fully statically linked, no extra shared libraries or compatibility shims are needed — the Dockerfile remains unchanged from the original Alpine-based setup (eclipse-temurin:25.0.2_10-jre-alpine,apk add --no-cache libstdc++ icu-libs).Challenge 63 container test
src/main/resources/challenges/challenge-63/Dockerfile_challenge63— a minimalalpine:3.21container that copieswrongsecrets-swift-linux-musland verifies it produces non-empty output (the hardcoded secret)container_test.yml— new CI jobChallenge 63 Swift binary testthat builds this image from the repo root and runs it, failing if the binary produces no outputDocker container JAR size reduction
.github/scripts/docker-create.sh— Extended the binary removal list from 7 entries to 41 entries to reduce the JAR size in the Docker image. All non-musl, non-Windows binaries that are never used on Alpine are now stripped from the JAR at build time, organized into three groups:.exefiles (unchanged wildcard removal)wrongsecrets-golang-linuxandwrongsecrets-golang-linux-armare intentionally kept:BinaryExecutionHelperskips the-muslsuffix for golang, so these glibc-linked binaries are used even on Alpine (amd64 and arm64 respectively).Explanation content
challenge63.adoc— problem statement (part 5 of the binary series)challenge63_hint.adoc— solve paths via Ghidra, radare2, andnm+swift-demanglechallenge63_reason.adoc— security lesson on Swift binary reverse engineeringOriginal prompt
💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.