Native languages round 2: SWift! - Githubissues

OWASP / wrongsecrets

Vulnerable app with examples showing how to not use secrets

https://owasp.org/www-project-wrongsecrets/

GNU Affero General Public License v3.0

1.2k stars 333 forks source link

Native languages round 2: SWift! #615

Open commjoen opened 1 year ago

commjoen commented 1 year ago

This challenge is about finding hardcoded secrets in binaries in Swift! With this we want to explain to our users that no language or binary is safe to just put the secret in offline. For this you need to:

[ ] Add a swift binary to the wrongsecrets/binaries repowith crosscompiling for the various OSes
[ ] Add a challenge here that uses the binary (See contributing.md and the code of the other binary challenges).

commjoen commented 6 months ago

https://github.com/compnerd/gha-setup-swift and https://github.com/marketplace/actions/install-swift-on-linux for github actions to build for linux and windows

commjoen commented 6 months ago

https://www.swift.org/documentation/server/guides/building.html

commjoen commented 6 months ago

https://github.com/OWASP/wrongsecrets-binaries/pull/50 is almost complete: is just needs alpine support in order to build out the challenge.

commjoen commented 6 months ago

In order to continue this challenge, we will first have to wait for Alpine support. Let's wait for https://github.com/apple/swift/pull/62245 to be completed. We contacted the developer on whether there is a way to use his work already to compile our https://github.com/OWASP/wrongsecrets-binaries/pull/50 for Alpine.

commjoen commented 6 months ago

Status update: I did not find any way to use the code on all designated platforms. I could not make run swift on alpine. We tested various glibc methods on musl as well and they don’t work either. Maybe fully static linking could do?