CI/CD Attacks
Offensive research of systems and processes related to developing and deploying code.
Contents
Techniques
Publicly Exposed Sensitive Data
A tool that can reveal deleted GitLab commits that potentially contain sensitive information and are not accessible via the public Git history.
A tool that can reveal deleted GitHub commits that potentially contain sensitive information and are not accessible via the public Git history.
Initial Code Execution
Post Exploitation
Defense Evasion
Hide commits in a GitHub PR.
A critical vulnerability in GitHub Actions, involving a misconfigured self-hosted runner in the actions/runner-images repository, allowed potential compromise of all GitHub and Azure hosted runner images.
Hide commits in a GitHub PR.
Tools
Azure DevOps Services Attack Toolkit.
GitHub Attack Toolkit.
GitHub Attack Toolkit - Extreme Edition.
Dump Git repository from a website.
OSINT tool to investigate GitHub profiles.
This tool can manage Jenkins tasks, like listing jobs, dumping credentials, running commands/scripts, and managing API tokens.
A tool to extract secrets stored inside CI/CD environments.
Notes about attacking Jenkins servers.
The largest open-source database for detecting secrets, API keys, passwords, tokens, and more.
Static analysis for GitHub Actions.