Gato
A security tool for enumerating and exploiting pipeline vulnerabilities in GitHub Actions workflows and self-hosted runners.
What is Gato?
Gato is a security tool for enumerating and attacking vulnerabilities in GitHub Actions pipelines and self-hosted runners. It helps identify security weaknesses such as poisoned workflow execution, exposed secrets in artifacts, and misconfigured self-hosted runners. The tool automates both reconnaissance and exploitation phases to assess the security posture of GitHub organizations.
Security engineers, red teamers, blue teams building detections, and bug bounty hunters focused on GitHub ecosystem security. It's designed for professionals who need to assess pipeline vulnerabilities at scale.
Gato provides a specialized, automated toolkit for GitHub pipeline security that combines enumeration, secrets scanning, and attack capabilities in one tool. Its ability to scale across organizations and integrate with tools like NoseyParker makes it uniquely suited for comprehensive GitHub security assessments.
Overview
GitHub Actions Pipeline Enumeration and Attack Tool
Use Cases
Best For
- Assessing the attack surface of GitHub organizations using self-hosted runners
- Identifying exposed secrets in GitHub Actions workflow artifacts
- Testing the impact of a compromised GitHub Personal Access Token
- Building detections for self-hosted runner attacks as a blue teamer
- Conducting bug bounty hunting on organizations with GitHub Actions pipelines
- Automating security assessments of GitHub workflows at scale
Not Ideal For
- Teams assessing CI/CD security on platforms other than GitHub, such as GitLab or Jenkins
- Organizations that require only passive vulnerability scanning without active exploitation capabilities
- Projects with limited resources to manage Python dependencies and external tools like NoseyParker
Pros & Cons
Pros
Optimized to scan top 200 GitHub organizations within 48 hours by setting constraints on artifact downloads, as detailed in the version 1.7 notes for efficient large-scale assessments.
Uses NoseyParker to scan workflow artifacts for exposed secrets, with configurable flags to reduce false positives, enhancing accuracy in secret detection.
Includes features for creating fork PRs and workflows to execute commands and exfiltrate secrets, enabling realistic proof-of-concept attacks for security testing.
Combines PAT privilege assessment, self-hosted runner identification via workflow and run-log analysis, and artifact scanning for a holistic view of pipeline vulnerabilities.
Cons
Requires NoseyParker installed in PATH for secrets scanning, plus specific versions of git and sed, adding complexity to setup and maintenance.
Exclusively targets GitHub Actions and self-hosted runners, making it ineffective for other CI/CD systems without significant customization or extensions.
Imposes limits like downloading max 50 artifacts per repository, which could miss vulnerabilities in larger or more active repos, though configurable in code.
Frequently Asked Questions
Related Projects
zizmorStatic analysis for GitHub Actions
git-dumperA tool to dump a git repository from a website
pwn_jenkinsNotes about attacking Jenkins servers
Secrets Patterns DatabaseSecrets Patterns DB: The largest open-source Database for detecting secrets, API keys, passwords, tokens, and more.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.