Gato
A security tool for enumerating and exploiting pipeline vulnerabilities in GitHub Actions workflows and self-hosted runners.
What is Gato?
Gato is a security tool for enumerating and attacking vulnerabilities in GitHub Actions pipelines and self-hosted runners. It helps identify security weaknesses such as poisoned workflow execution, exposed secrets in artifacts, and misconfigured self-hosted runners. The tool automates both reconnaissance and exploitation phases to assess the security posture of GitHub organizations.
Security engineers, red teamers, blue teams building detections, and bug bounty hunters focused on GitHub ecosystem security. It's designed for professionals who need to assess pipeline vulnerabilities at scale.
Gato provides a specialized, automated toolkit for GitHub pipeline security that combines enumeration, secrets scanning, and attack capabilities in one tool. Its ability to scale across organizations and integrate with tools like NoseyParker makes it uniquely suited for comprehensive GitHub security assessments.
Overview
GitHub Actions Pipeline Enumeration and Attack Tool
Use Cases
Best For
- Assessing the attack surface of GitHub organizations using self-hosted runners
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
