webhard
awesome pipeline
kalmarctf
Task: Forgejo provisions a personal repository and stores the flag as an Actions secret. Solution: abuse shell injection in `${{ github.head_ref }}` under `pull_request_target`, poison `GITHUB_OUTPUT`, and turn a later `cp -r` step into a secret leak.
$ ls tags/ techniques/
branch_name_shell_injectionworkflow_output_poisoninggithub_output_injectionpull_request_target_secret_leak
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Create a free account with GitHub to get started.
$ssh [email protected]