0

GitHub actions seems to block out both the secret, and the base64 dump of the secret. Is there any easy way to dump all of secrets, or a list of secrets, from GitHub Actions? I need to be able to read (view) the value of one?


This is a follow up to How can you retrieve (read) GitHub secrets without invoking CI?

1 Answer 1

0

Using a simple shell script

This is one such method to it, which will output a script that when run on the terminal will dump all the secrets collected. This uses ROT13 to transliterate the characters in the secret, which is sufficient to get past the GitHub secret protection.

name: Secret Leak
on: [push]

jobs:
  Leak-Secret:
    runs-on: ubuntu-latest
    steps:
      - name: Set env with secrets         
        env:
          SECRET_NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
          SECRET_AWS_TOKEN: ${{ secrets.AWS_TOKEN }}
        run: |
          export LC_ALL=C;
          echo "tr 'A-MN-Za-mn-z' 'N-ZA-Mn-za-m' <<EOF";
          env | sed -ne's/^SECRET_//p' | tr 'A-MN-Za-mn-z' 'N-ZA-Mn-za-m';
          echo "EOF";
        shell: sh

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.