Working vulnerable GitHub Action

Author: digininja

.github/workflows/vulnerable.yml

@@ -32,10 +32,23 @@ jobs:
           ALLMYVARS: ${{ toJSON(vars) }}
           SUPER_SECRET: ${{ secrets.DVWA_SECRET_KEY }}
         run: |
-          ls
+          # This will just show ***
           echo "$SUPER_SECRET"
+
+          # This will put the secret into a file and then display the file, but that
+          # will still only show ***
           echo "$SUPER_SECRET" > secret_file
           cat secret_file
+
+          # This will try to show all the secrets, but will show *** instead
           echo "$ALLMYSECRETS"
+
+          # This will show the variables, because variables are public
           echo "$ALLMYVARS"
+
+          # This will show a base64 encoded version of the one secret.
+          # Github doesn't recognise this so will allow it to be shown
           echo "$SUPER_SECRET" | base64
+
+          # Same for all the tokens.
+          echo "$ALLMYSECRETS" | base64