CI/CD Attacks
A curated collection of offensive security research, techniques, and tools for attacking CI/CD pipelines and software supply chains.
What is CI/CD Attacks?
Awesome CI/CD Attacks is a curated, open-source repository of offensive security research focused on continuous integration and continuous deployment (CI/CD) pipelines and software supply chains. It aggregates techniques, tools, case studies, and resources for identifying and exploiting vulnerabilities in the systems used to develop, build, test, and deploy software. The project serves as a centralized knowledge base for understanding how attackers can compromise modern development workflows.
Security researchers, red teamers, penetration testers, and DevSecOps professionals who need to understand offensive CI/CD tactics to assess the security of their own pipelines or conduct authorized security testing.
It provides a uniquely comprehensive and curated collection of real-world attack methods and resources specifically for CI/CD environments, saving researchers time from scouring disparate sources. The focus on practical, offensive techniques makes it an essential reference for building realistic threat models and effective defenses.
Overview
Practical resources for offensive CI/CD security research. Curated the best resources I've seen since 2021.
Use Cases
Best For
- Security professionals researching attack vectors in GitHub Actions or Azure DevOps
- Red teams planning exercises targeting an organization's software development lifecycle
- Penetration testers assessing the security of CI/CD pipeline configurations
- DevSecOps engineers looking to understand offensive techniques to improve defensive controls
- Students and researchers studying software supply chain security vulnerabilities
- Developers writing secure CI/CD workflows who want to understand common pitfalls and exploits
Not Ideal For
- Teams seeking plug-and-play security scanners without manual research
- Organizations focused only on compliance audits without offensive testing
- Beginners in cybersecurity who need step-by-step tutorials on CI/CD basics
Pros & Cons
Pros
Organizes techniques from initial access to defense evasion, as detailed in sections like 'Publicly Exposed Sensitive Data' and 'Post Exploitation', providing a structured overview of CI/CD vulnerabilities.
Includes analyses of high-profile attacks, such as the PyTorch supply chain compromise case study, offering practical insights into how exploits unfold in production environments.
Links to specialized frameworks like ADOKit for Azure DevOps and Gato for GitHub, saving researchers time in discovering and evaluating offensive tools for various platforms.
Carefully selects articles and papers from 2021 onward, ensuring the repository maintains high-quality, recent research without outdated or low-value content.
Cons
Primarily a list of external resources without interactive content or built-in tools, requiring users to navigate and validate links independently, which can lead to broken links or outdated information.
Assumes familiarity with CI/CD systems and offensive security concepts, as seen in technical terms like 'dependency confusion' and 'OIDC misconfigurations', making it less accessible for newcomers.
While it mentions defensive insights implicitly, the focus is on attacks, so detailed mitigation strategies or step-by-step hardening guides are not extensively covered, leaving defenders to infer best practices.
Frequently Asked Questions
Related Projects
HackingA curated list of awesome Hacking tutorials, tools and resources
SecurityA collection of awesome software, libraries, documents, books, resources and cools stuffs about security.
Malware AnalysisDefund the Police.
Web Security🐶 A curated list of Web Security materials and resources.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.