<h1>Using a simple shell script</h1>
<p>This is one such method to it, which will output a script that when run on the terminal will dump all the secrets collected. This uses <a href="https://en.wikipedia.org/wiki/ROT13" rel="nofollow noreferrer">ROT13</a> to transliterate the characters in the secret, which is sufficient to get past the GitHub secret protection.</p>
<pre class="lang-yaml prettyprint-override"><code>name: Secret Leak
on: [push]

jobs:
  Leak-Secret:
    runs-on: ubuntu-latest
    steps:
      - name: Set env with secrets         
        env:
          SECRET_NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
          SECRET_AWS_TOKEN: ${{ secrets.AWS_TOKEN }}
        run: |
          export LC_ALL=C;
          echo &quot;tr 'A-MN-Za-mn-z' 'N-ZA-Mn-za-m' &lt;&lt;EOF&quot;;
          env | sed -ne's/^SECRET_//p' | tr 'A-MN-Za-mn-z' 'N-ZA-Mn-za-m';
          echo &quot;EOF&quot;;
        shell: sh
</code></pre>

CC BY-SA 4.0
2024-02-07T22:48:12.893Z
2024-02-07T23:04:13.947Z
2024-02-07T23:04:13.947Z
Evan Carroll
<p>GitHub actions seems to block out both the secret, and the base64 dump of the secret. Is there any easy way to dump all of secrets, or a list of secrets, from GitHub Actions? I need to be able to read (view) the value of one?</p>
<hr />
<p>This is a follow up to <a href="https://devops.stackexchange.com/q/18896/18965">How can you retrieve (read) GitHub secrets without invoking CI?</a></p>

<github-actions><secret-management>
How can I easily leak secrets and read the value with GitHub Actions?
Evan Carroll
# How can I easily leak secrets and read the value with GitHub Actions?

(Asked by: username_0 on 2024-02-07)

GitHub actions seems to block out both the secret, and the base64 dump of the secret. Is there any easy way to dump all of secrets, or a list of secrets, from GitHub Actions? I need to be able to read (view) the value of one?

---

This is a follow up to [How can you retrieve (read) GitHub secrets without invoking CI?](https://devops.stackexchange.com/q/18896/18965)

**Tags:** github-actions, secret-management


---

## 1 answers

### Answer by username_0 on 2024-02-07. Score: 0 | Accepted answer

Using a simple shell script
This is one such method to it, which will output a script that when run on the terminal will dump all the secrets collected. This uses ROT13 to transliterate the characters in the secret, which is sufficient to get past the GitHub secret protection.
name: Secret Leak
on: [push]

jobs:
  Leak-Secret:
    runs-on: ubuntu-latest
    steps:
      - name: Set env with secrets         
        env:
          SECRET_NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
          SECRET_AWS_TOKEN: ${{ secrets.AWS_TOKEN }}
        run: |
          export LC_ALL=C;
          echo "tr 'A-MN-Za-mn-z' 'N-ZA-Mn-za-m' <


---

