webProhard

awesome pipeline

kalmarctf

Task: Forgejo provisions a personal repository and stores the flag as an Actions secret. Solution: abuse shell injection in `${{ github.head_ref }}` under `pull_request_target`, poison `GITHUB_OUTPUT`, and turn a later `cp -r` step into a secret leak.

$ ls tags/ techniques/
command_injectionforgejogitea_actionsgithub_actionspull_request_targetci_cdactions_secret
branch_name_shell_injectionworkflow_output_poisoninggithub_output_injectionpull_request_target_secret_leak
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups