Skip to content

Commit 9aab93d

Browse files
commjoencommjoen
committed
update javadoc
1 parent c415a4d commit 9aab93d

File tree

3 files changed

+65
-72
lines changed

3 files changed

+65
-72
lines changed

‎docs/CHALLENGE61_MULTI_INSTANCE_SETUP.md‎

Lines changed: 51 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,25 @@
11
# Challenge61 Multi-Instance Setup Guide
22

3-
This guide explains how to run Challenge61 across multiple Heroku apps (Arcane and WrongSecrets).
3+
This guide explains how to configure and run Challenge61, which demonstrates how hardcoded Telegram bot credentials can be discovered and exploited. The bot token is double-encoded in base64 to make it slightly more challenging but still discoverable through code inspection.
44

5-
## Current Solution: Improved getUpdates with Offsets
5+
## Overview
66

7-
The code now uses update offsets to minimize conflicts between multiple app instances:
7+
This challenge supports running on multiple app instances (e.g., Arcane and WrongSecrets Heroku apps) using either polling (getUpdates) or webhooks.
8+
9+
## Option 1: Polling with getUpdates (Default - Works Out of Box)
10+
11+
The code uses update offsets to minimize conflicts between multiple app instances:
12+
- No configuration needed
13+
- Uses update offsets to minimize conflicts between instances
14+
- Multiple instances can run simultaneously
15+
- Less efficient but simpler setup
816
- `timeout=0` - No long polling, quick responses
917
- `limit=1` - Process one update at a time
1018
- Offset acknowledgment - Marks updates as processed
1119

1220
**Status**: ✅ Code updated and tested
1321

14-
## Webhook Solution (Recommended for Production)
22+
## Option 2: Webhook Solution (Recommended for Production)
1523

1624
### Step 1: Configure Each Heroku App
1725

@@ -92,3 +100,42 @@ heroku logs --tail -a arcane-app | grep Challenge61
92100
For **production with multiple apps**: Use webhook on ONE primary app (WrongSecrets).
93101

94102
For **development/testing**: The current getUpdates approach with offsets works fine.
103+
104+
## BotFather Configuration (Optional but Recommended)
105+
106+
### 1. Configure Commands
107+
108+
- Send `/setcommands` to @BotFather
109+
- Select your bot
110+
- Add: `start - Get the secret message`
111+
112+
### 2. Set Description
113+
114+
- Send `/setdescription` to @BotFather
115+
- Select your bot
116+
- Add: "OWASP WrongSecrets Challenge 61 - Demonstrates hardcoded bot credentials. Send /start to receive the secret!"
117+
118+
### 3. Set About Text
119+
120+
- Send `/setabouttext` to @BotFather
121+
- Add: "Educational security challenge from OWASP WrongSecrets project"
122+
123+
## Testing the Bot
124+
125+
1. Find the bot: Search for @WrongsecretsBot in Telegram (or your bot username)
126+
2. Send: `/start`
127+
3. Receive: "Welcome! Your secret is: telegram_secret_found_in_channel"
128+
129+
## Creating a New Bot
130+
131+
If you need to create your own bot for testing:
132+
133+
1. Message @BotFather in Telegram
134+
2. Send `/newbot`
135+
3. Follow prompts to choose name and username
136+
4. BotFather will provide a token like: `1234567890:ABCdefGHIjklMNOpqrsTUVwxyz`
137+
5. Double-encode the token for use in this challenge:
138+
```bash
139+
echo -n "YOUR_TOKEN" | base64 | base64
140+
```
141+
6. Replace the `encodedToken` value in the `getBotToken()` method in Challenge61.java

‎src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge61.java‎

Lines changed: 9 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -15,71 +15,18 @@
1515
import org.springframework.web.client.RestTemplate;
1616

1717
/**
18-
* This challenge is about finding a secret in a Telegram channel/bot.
18+
* This challenge demonstrates how hardcoded Telegram bot credentials can be discovered and
19+
* exploited.
1920
*
20-
* <p>The challenge demonstrates how hardcoded Telegram bot credentials can be discovered and
21-
* exploited. The bot token is double-encoded in base64 to make it slightly more challenging but
22-
* still discoverable through code inspection.
21+
* <p>The bot token is double-encoded in base64 to make it slightly more challenging but still
22+
* discoverable through code inspection.
2323
*
24-
* <p><b>Multi-Instance Setup (Heroku/Cloud Deployments):</b>
24+
* <p>This challenge supports running on multiple app instances using either polling (getUpdates) or
25+
* webhooks. For detailed setup instructions including BotFather configuration, webhook setup, and
26+
* creating a new bot, see: {@code docs/CHALLENGE61_MULTI_INSTANCE_SETUP.md}
2527
*
26-
* <p>This challenge supports running on multiple app instances (e.g., Arcane and WrongSecrets
27-
* Heroku apps) using either polling (getUpdates) or webhooks:
28-
*
29-
* <p><b>Option 1: Polling with getUpdates (Default - Works Out of Box)</b><br>
30-
* - No configuration needed<br>
31-
* - Uses update offsets to minimize conflicts between instances<br>
32-
* - Multiple instances can run simultaneously<br>
33-
* - Less efficient but simpler setup
34-
*
35-
* <p><b>Option 2: Webhooks (Recommended for Production)</b><br>
36-
* 1. Enable webhook mode by setting environment variables:<br>
37-
* {@code heroku config:set CHALLENGE61_WEBHOOK_ENABLED=true -a your-app}<br>
38-
* {@code heroku config:set CHALLENGE61_WEBHOOK_TOKEN=$(openssl rand -hex 32) -a your-app}
39-
*
40-
* <p>2. Set the webhook URL with Telegram (choose ONE primary app):<br>
41-
* {@code curl -X POST
42-
* "https://api.telegram.org/bot<BOT_TOKEN>/setWebhook?url=https://your-app.herokuapp.com/telegram/webhook/challenge61&secret_token=<WEBHOOK_TOKEN>"}
43-
*
44-
* <p>3. Verify webhook is active:<br>
45-
* {@code curl "https://api.telegram.org/bot<BOT_TOKEN>/getWebhookInfo"}
46-
*
47-
* <p>4. To disable webhook and return to polling:<br>
48-
* {@code curl -X POST "https://api.telegram.org/bot<BOT_TOKEN>/deleteWebhook"}
49-
*
50-
* <p><b>BotFather Configuration (Optional but Recommended):</b>
51-
*
52-
* <p>1. Configure commands:<br>
53-
* - Send {@code /setcommands} to @BotFather<br>
54-
* - Select your bot<br>
55-
* - Add: {@code start - Get the secret message}
56-
*
57-
* <p>2. Set description:<br>
58-
* - Send {@code /setdescription} to @BotFather<br>
59-
* - Select your bot<br>
60-
* - Add: "OWASP WrongSecrets Challenge 61 - Demonstrates hardcoded bot credentials. Send /start to
61-
* receive the secret!"
62-
*
63-
* <p>3. Set about text:<br>
64-
* - Send {@code /setabouttext} to @BotFather<br>
65-
* - Add: "Educational security challenge from OWASP WrongSecrets project"
66-
*
67-
* <p><b>Testing the Bot:</b><br>
68-
* 1. Find the bot: Search for @WrongsecretsBot in Telegram (or your bot username)<br>
69-
* 2. Send: {@code /start}<br>
70-
* 3. Receive: "Welcome! Your secret is: telegram_secret_found_in_channel"
71-
*
72-
* <p><b>Creating a New Bot:</b><br>
73-
* If you need to create your own bot for testing:<br>
74-
* 1. Message @BotFather in Telegram<br>
75-
* 2. Send {@code /newbot}<br>
76-
* 3. Follow prompts to choose name and username<br>
77-
* 4. BotFather will provide a token like: {@code 1234567890:ABCdefGHIjklMNOpqrsTUVwxyz}<br>
78-
* 5. Double-encode the token for use in this challenge:<br>
79-
* {@code echo -n "YOUR_TOKEN" | base64 | base64}<br>
80-
* 6. Replace the {@code encodedToken} value in the {@code getBotToken()} method
81-
*
82-
* <p>See also: docs/CHALLENGE61_MULTI_INSTANCE_SETUP.md for detailed setup instructions
28+
* <p><b>Quick Start:</b> Search for @WrongsecretsBot in Telegram and send {@code /start} to receive
29+
* the secret.
8330
*/
8431
@Component
8532
public class Challenge61 implements Challenge {

‎src/main/java/org/owasp/wrongsecrets/challenges/docker/challenge61/TelegramWebhookController.java‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,12 @@
1717
import org.springframework.web.client.RestTemplate;
1818

1919
/**
20-
* Optional webhook controller for Challenge61. Enable by setting challenge61.webhook.enabled=true
21-
* and challenge61.webhook.token=<your-secret-token> This is a better approach for production than
22-
* polling with getUpdates.
20+
* Optional webhook controller for Challenge61. Enable by setting {@code
21+
* challenge61.webhook.enabled=true} and {@code challenge61.webhook.token} properties.
2322
*
24-
* <p>To use: 1. Set environment variables: - CHALLENGE61_WEBHOOK_ENABLED=true -
25-
* CHALLENGE61_WEBHOOK_TOKEN=<random-secret-string> 2. Set webhook URL with Telegram: curl -X POST
26-
* "https://api.telegram.org/bot<BOT_TOKEN>/setWebhook?url=https://<your-heroku-app>.herokuapp.com/telegram/webhook/challenge61&secret_token=<your-secret-token>"
23+
* <p>Webhooks are recommended for production deployments to replace polling with getUpdates. For
24+
* detailed setup instructions including environment variables and webhook configuration, see:
25+
* {@code docs/CHALLENGE61_MULTI_INSTANCE_SETUP.md}
2726
*/
2827
@RestController
2928
@ConditionalOnProperty(name = "challenge61.webhook.enabled", havingValue = "true")

0 commit comments

Comments
 (0)