Add Java CLI reverse-engineering challenges and bundle JAR variants by Copilot · Pull Request #2523 · OWASP/wrongsecrets

Copilot · 2026-05-11T06:58:22Z

This adds WrongSecrets challenges based on the new Java CLIs introduced in OWASP/wrongsecrets-binaries#130. It covers both the plain and obfuscated Java variants and includes the relevant bundled artifacts, including CTF builds.

New challenges
- Add Challenge65 for the plain Java CLI JAR
- Add Challenge66 for the obfuscated Java CLI JAR
- Register both challenges in wrong-secrets-configuration.yaml with matching explanation, hint, and reason content
Java JAR execution support
- Extend BinaryExecutionHelper to execute runnable JARs via java -jar
- Reuse the existing binary challenge flow so spoil() resolves the embedded secret from the packaged CLI rather than duplicating logic in application code
Bundled Java artifacts
- Add the Java CLI variants under src/main/resources/executables/
  - wrongsecrets-java.jar
  - wrongsecrets-java-obfuscated.jar
  - wrongsecrets-java-ctf.jar
  - wrongsecrets-java-obfuscated-ctf.jar
- Update .gitignore so these tracked JARs can live alongside the existing executable assets
Challenge docs and tests
- Add focused AsciiDoc content for both Java challenges
- Add challenge tests covering the new plain and obfuscated JAR-backed flows

Example of the new execution path:

@Override
public String getAnswer() {
  BinaryExecutionHelper helper = new BinaryExecutionHelper(65, new MuslDetectorImpl());
  return helper.executeJavaJar("", "wrongsecrets-java.jar");
}

Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/f2ea090d-47bb-4e0a-ad4c-179c568545a8 Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>

commjoen · 2026-05-11T07:00:55Z

+You can solve it by:
+
+1. Decompiling the classes and following the code that reconstructs the secret.
+2. Looking for encoded byte arrays, reflection, and helper methods that decode data at runtime.


@copilot can you be more explicit in the steps here please? what does the user exactly need to do?

Updated with explicit step-by-step instructions for decompiling, inspecting bytecode, and running the JAR locally in 928795e.

Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/ffd37450-0343-442a-abee-851241cb0eff Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>

github-actions · 2026-05-11T07:04:08Z

🌐 GitHub Pages Preview Ready!

Your static preview is now available at:
🔗 Preview PR #2523

📄 What's included:

✅ All CSS, JavaScript, and static assets (embedded inline)
✅ Current styling and layout preview
✅ Images, icons, and UI components
✅ NEW: Generated HTML from Thymeleaf templates
- 🏠 Home/Welcome Page
- ℹ️ About Page
- 📊 Stats & Config Page
- 🤖 Challenge 57: LLM Security (Latest)
- 🧩 Challenge Example

For full functionality testing: Use the Docker preview instead.

🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR.

_{Static preview with Thymeleaf generation by GitHub Actions}

github-actions · 2026-05-11T07:12:08Z

🔨 Preview Build Complete!

Your changes have been built and pushed to GitHub Container Registry.

🐳 Docker Image: ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2523-6714add

📦 Download & Test Locally:

📁 Download Docker Image Artifact (look for wrongsecrets-preview-pr-2523)
Load and run the image:

# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview

🚀 Alternative - Pull from Registry:

docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2523-6714add
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2523-6714add

Then visit: http://localhost:8080

📝 Changes in this PR:
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge65.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge66.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/binaryexecution/BinaryExecutionHelper.java
- src/main/resources/explanations/challenge65.adoc
- src/main/resources/explanations/challenge65_hint.adoc
- src/main/resources/explanations/challenge65_reason.adoc
- src/main/resources/explanations/challenge66.adoc
- src/main/resources/explanations/challenge66_hint.adoc
- src/main/resources/explanations/challenge66_reason.adoc

Visual diff screenshots will be available shortly...

_{Preview built by GitHub Actions}

github-actions · 2026-05-11T07:18:10Z

📸 Visual Diff Ready!

Screenshots comparing your changes with the main branch are available:

📁 Download Visual Diff Artifacts

🖼️ Included screenshots:

pr-home.png vs main-home.png - Welcome page comparison
pr-about.png vs main-about.png - About page comparison
pr-challenge.png vs main-challenge.png - Challenge page comparison

🔍 How to review:

Download the artifact zip file
Extract and compare the pr-* and main-* images side by side
Look for visual differences in layout, styling, and content

💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily.

_{Visual diff generated by GitHub Actions • PR #2523}

commjoen · 2026-05-15T10:03:26Z

@copilot can you update the documentaiton as well please?

github-actions · 2026-05-15T10:05:11Z

🌐 GitHub Pages Preview Ready!

Your static preview is now available at:
🔗 Preview PR #2523

📄 What's included:

✅ All CSS, JavaScript, and static assets (embedded inline)
✅ Current styling and layout preview
✅ Images, icons, and UI components
✅ NEW: Generated HTML from Thymeleaf templates
- 🏠 Home/Welcome Page
- ℹ️ About Page
- 📊 Stats & Config Page
- 🤖 Challenge 57: LLM Security (Latest)
- 🧩 Challenge Example

For full functionality testing: Use the Docker preview instead.

🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR.

_{Static preview with Thymeleaf generation by GitHub Actions}

Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/f5613696-4b1f-4899-844f-53b020e7c5e3 Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>

Copilot · 2026-05-15T10:08:10Z

@copilot can you update the documentaiton as well please?

Updated the Challenge 66 explanation text as well so the main documentation now walks through downloading the JAR, running spoil, decompiling it, tracing the decoding logic, and submitting the recovered secret in 63dc675.

github-actions · 2026-05-15T10:10:23Z

🔨 Preview Build Complete!

Your changes have been built and pushed to GitHub Container Registry.

🐳 Docker Image: ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2523-2a33460

📦 Download & Test Locally:

📁 Download Docker Image Artifact (look for wrongsecrets-preview-pr-2523)
Load and run the image:

# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview

🚀 Alternative - Pull from Registry:

docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2523-2a33460
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2523-2a33460

Then visit: http://localhost:8080

📝 Changes in this PR:
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge65.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge66.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/binaryexecution/BinaryExecutionHelper.java
- src/main/resources/explanations/challenge65.adoc
- src/main/resources/explanations/challenge65_hint.adoc
- src/main/resources/explanations/challenge65_reason.adoc
- src/main/resources/explanations/challenge66.adoc
- src/main/resources/explanations/challenge66_hint.adoc
- src/main/resources/explanations/challenge66_reason.adoc

Visual diff screenshots will be available shortly...

_{Preview built by GitHub Actions}

github-actions · 2026-05-15T10:14:54Z

📸 Visual Diff Ready!

Screenshots comparing your changes with the main branch are available:

📁 Download Visual Diff Artifacts

🖼️ Included screenshots:

pr-home.png vs main-home.png - Welcome page comparison
pr-about.png vs main-about.png - About page comparison
pr-challenge.png vs main-challenge.png - Challenge page comparison

🔍 How to review:

Download the artifact zip file
Extract and compare the pr-* and main-* images side by side
Look for visual differences in layout, styling, and content

💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily.

_{Visual diff generated by GitHub Actions • PR #2523}

commjoen · 2026-05-17T20:57:31Z

@copilot instead of using spoil, how could an attacker find the array and decode it instead? Can you use that as the hints steps?

github-actions · 2026-05-17T20:58:04Z

🌐 GitHub Pages Preview Ready!

Your static preview is now available at:
🔗 Preview PR #2523

📄 What's included:

✅ All CSS, JavaScript, and static assets (embedded inline)
✅ Current styling and layout preview
✅ Images, icons, and UI components
✅ NEW: Generated HTML from Thymeleaf templates
- 🏠 Home/Welcome Page
- ℹ️ About Page
- 📊 Stats & Config Page
- 🤖 Challenge 57: LLM Security (Latest)
- 🧩 Challenge Example

For full functionality testing: Use the Docker preview instead.

🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR.

_{Static preview with Thymeleaf generation by GitHub Actions}

Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/338d4353-a2d0-48a3-a0bb-2dea0c76d235 Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>

Copilot · 2026-05-17T21:04:10Z

@copilot instead of using spoil, how could an attacker find the array and decode it instead? Can you use that as the hints steps?

Updated the Challenge 66 hint steps to focus on locating WrongSecretsObfuscated.class, extracting XOR_KEY_CHARS and ENCODED_SECRET, tracing decodeSecret(), and rebuilding the secret without using spoil in bfb629e.

Screenshot:

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

accounts.google.com
- Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=4999 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/org.chromium.Chromium.scoped_dir.9LZ3IT --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,8828843397190078902,7587338667278405990,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,12403235434011049529,14081084788277886150,4 --trace-process-track-uuid=3190708989122997041 (dns block)
- Triggering command: /usr/bin/chromium chromium --headless --no-sandbox --disable-gpu --window-size=1400,2200 --screenshot=/tmp/wrongsecrets-screens/challenge66-hint.png REDACTED (dns block)
clients2.google.com
- Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=4999 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/org.chromium.Chromium.scoped_dir.9LZ3IT --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,8828843397190078902,7587338667278405990,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,12403235434011049529,14081084788277886150,4 --trace-process-track-uuid=3190708989122997041 (dns block)
- Triggering command: /usr/bin/chromium chromium --headless --no-sandbox --disable-gpu --window-size=1400,2200 --screenshot=/tmp/wrongsecrets-screens/challenge66-hint.png REDACTED (dns block)
content-autofill.googleapis.com
- Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=4999 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/org.chromium.Chromium.scoped_dir.9LZ3IT --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,8828843397190078902,7587338667278405990,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,12403235434011049529,14081084788277886150,4 --trace-process-track-uuid=3190708989122997041 (dns block)
- Triggering command: /usr/bin/chromium chromium --headless --no-sandbox --disable-gpu --window-size=1400,2200 --screenshot=/tmp/wrongsecrets-screens/challenge66-hint.png REDACTED (dns block)
redirector.gvt1.com
- Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=4999 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/org.chromium.Chromium.scoped_dir.9LZ3IT --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,8828843397190078902,7587338667278405990,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,12403235434011049529,14081084788277886150,4 --trace-process-track-uuid=3190708989122997041 (dns block)
- Triggering command: /usr/bin/chromium chromium --headless --no-sandbox --disable-gpu --window-size=1400,2200 --screenshot=/tmp/wrongsecrets-screens/challenge66-hint.png REDACTED (dns block)
www.google.com
- Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=4999 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/org.chromium.Chromium.scoped_dir.9LZ3IT --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,8828843397190078902,7587338667278405990,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,12403235434011049529,14081084788277886150,4 --trace-process-track-uuid=3190708989122997041 (dns block)
- Triggering command: /usr/bin/chromium chromium --headless --no-sandbox --disable-gpu --window-size=1400,2200 --screenshot=/tmp/wrongsecrets-screens/challenge66-hint.png REDACTED (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

github-actions · 2026-05-17T21:05:44Z

🔨 Preview Build Complete!

Your changes have been built and pushed to GitHub Container Registry.

🐳 Docker Image: ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2523-6d2b4fa

📦 Download & Test Locally:

📁 Download Docker Image Artifact (look for wrongsecrets-preview-pr-2523)
Load and run the image:

# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview

🚀 Alternative - Pull from Registry:

docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2523-6d2b4fa
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2523-6d2b4fa

Then visit: http://localhost:8080

📝 Changes in this PR:
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge65.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge66.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/binaryexecution/BinaryExecutionHelper.java
- src/main/resources/explanations/challenge65.adoc
- src/main/resources/explanations/challenge65_hint.adoc
- src/main/resources/explanations/challenge65_reason.adoc
- src/main/resources/explanations/challenge66.adoc
- src/main/resources/explanations/challenge66_hint.adoc
- src/main/resources/explanations/challenge66_reason.adoc

Visual diff screenshots will be available shortly...

_{Preview built by GitHub Actions}

github-actions · 2026-05-17T21:09:49Z

📸 Visual Diff Ready!

Screenshots comparing your changes with the main branch are available:

📁 Download Visual Diff Artifacts

🖼️ Included screenshots:

pr-home.png vs main-home.png - Welcome page comparison
pr-about.png vs main-about.png - About page comparison
pr-challenge.png vs main-challenge.png - Challenge page comparison

🔍 How to review:

Download the artifact zip file
Extract and compare the pr-* and main-* images side by side
Look for visual differences in layout, styling, and content

💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily.

_{Visual diff generated by GitHub Actions • PR #2523}

Copilot AI and others added 3 commits May 11, 2026 05:25

feat: add Java binary challenges and variants

ed790cd

Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/f2ea090d-47bb-4e0a-ad4c-179c568545a8 Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>

chore: add Java challenge artifacts

2c07848

Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/f2ea090d-47bb-4e0a-ad4c-179c568545a8 Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>

chore: polish Java jar helper

32f8930

Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/f2ea090d-47bb-4e0a-ad4c-179c568545a8 Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>

Copilot AI assigned Copilot and commjoen May 11, 2026

Copilot created this pull request from a session on behalf of commjoen May 11, 2026 06:58 View session

commjoen reviewed May 11, 2026

View reviewed changes

Copilot started work on behalf of commjoen May 11, 2026 07:01 View session

docs: expand challenge 66 hint steps

928795e

Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/ffd37450-0343-442a-abee-851241cb0eff Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>

Copilot AI temporarily deployed to github-pages May 11, 2026 07:03 Inactive

Copilot finished work on behalf of commjoen May 11, 2026 07:03

Copilot AI requested a review from commjoen May 11, 2026 07:03

commjoen marked this pull request as ready for review May 15, 2026 10:03

commjoen requested a review from bendehaan as a code owner May 15, 2026 10:03

Merge branch 'master' into copilot/add-cli-challenge-variants

8431c29

commjoen temporarily deployed to github-pages May 15, 2026 10:03 — with GitHub Actions Inactive

Copilot started work on behalf of commjoen May 15, 2026 10:03 View session

docs: expand challenge 66 explanation steps

63dc675

Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/f5613696-4b1f-4899-844f-53b020e7c5e3 Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>

Copilot finished work on behalf of commjoen May 15, 2026 10:09

Copilot AI deployed to github-pages May 17, 2026 20:56 View deployment

Copilot started work on behalf of commjoen May 17, 2026 20:57 View session

docs: refine challenge 66 reverse-engineering hints

bfb629e

Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/338d4353-a2d0-48a3-a0bb-2dea0c76d235 Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>

Copilot finished work on behalf of commjoen May 17, 2026 21:04

Uh oh!

Conversation

Copilot AI commented May 11, 2026

Uh oh!

commjoen May 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 11, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented May 11, 2026

Uh oh!

github-actions Bot commented May 11, 2026

Uh oh!

github-actions Bot commented May 11, 2026

Uh oh!

commjoen commented May 15, 2026

Uh oh!

github-actions Bot commented May 15, 2026

Uh oh!

Copilot AI commented May 15, 2026

Uh oh!

github-actions Bot commented May 15, 2026

Uh oh!

github-actions Bot commented May 15, 2026

Uh oh!

commjoen commented May 17, 2026

Uh oh!

github-actions Bot commented May 17, 2026

Uh oh!

Copilot AI commented May 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

github-actions Bot commented May 17, 2026

Uh oh!

github-actions Bot commented May 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented May 17, 2026 •

edited

Loading