Answers: <h1>Using a simple shell script</h1>
  <p>This is one such method to it, which will output a script that when run on the terminal will dump all the secrets collected. This uses <a href="https://en.wikipedia.org/wiki/ROT13" rel="nofollow noreferrer">ROT13</a> to transliterate the characters in the secret, which is sufficient to get past the GitHub secret protection.</p>
  <pre class="lang-yaml prettyprint-override"><code>name: Secret Leak
  on: [push]
  
  jobs:
    Leak-Secret:
      runs-on: ubuntu-latest
      steps:
        - name: Set env with secrets         
          env:
            SECRET_NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
            SECRET_AWS_TOKEN: ${{ secrets.AWS_TOKEN }}
          run: |
            export LC_ALL=C;
            echo &quot;tr 'A-MN-Za-mn-z' 'N-ZA-Mn-za-m' &lt;&lt;EOF&quot;;
            env | sed -ne's/^SECRET_//p' | tr 'A-MN-Za-mn-z' 'N-ZA-Mn-za-m';
            echo &quot;EOF&quot;;
          shell: sh
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2024-02-07T22:48:12.893Z
Answers: 2024-02-07T23:04:13.947Z
Answers: 2024-02-07T23:04:13.947Z
Answers: Evan Carroll
Body: <p>GitHub actions seems to block out both the secret, and the base64 dump of the secret. Is there any easy way to dump all of secrets, or a list of secrets, from GitHub Actions? I need to be able to read (view) the value of one?</p>
  <hr />
  <p>This is a follow up to <a href="https://devops.stackexchange.com/q/18896/18965">How can you retrieve (read) GitHub secrets without invoking CI?</a></p>
  
Tags: <github-actions><secret-management>
Title: How can I easily leak secrets and read the value with GitHub Actions?
UserDisplayName: Evan Carroll
ThreadText: # How can I easily leak secrets and read the value with GitHub Actions?
  
  (Asked by: username_0 on 2024-02-07)
  
  GitHub actions seems to block out both the secret, and the base64 dump of the secret. Is there any easy way to dump all of secrets, or a list of secrets, from GitHub Actions? I need to be able to read (view) the value of one?
  
  ---
  
  This is a follow up to [How can you retrieve (read) GitHub secrets without invoking CI?](https://devops.stackexchange.com/q/18896/18965)
  
  **Tags:** github-actions, secret-management
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2024-02-07. Score: 0 | Accepted answer
  
  # Using a simple shell script
  
  This is one such method to it, which will output a script that when run on the terminal will dump all the secrets collected. This uses [ROT13](https://en.wikipedia.org/wiki/ROT13) to transliterate the characters in the secret, which is sufficient to get past the GitHub secret protection.
  
  ```yaml
  name: Secret Leak
  on: [push]
  
  jobs:
    Leak-Secret:
      runs-on: ubuntu-latest
      steps:
        - name: Set env with secrets         
          env:
            SECRET_NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
            SECRET_AWS_TOKEN: ${{ secrets.AWS_TOKEN }}
          run: |
            export LC_ALL=C;
            echo "tr 'A-MN-Za-mn-z' 'N-ZA-Mn-za-m' <<EOF";
            env | sed -ne's/^SECRET_//p' | tr 'A-MN-Za-mn-z' 'N-ZA-Mn-za-m';
            echo "EOF";
          shell: sh
  
  ```
  
  
  ---
  
  