A tool for extracting secrets from CI/CD environments by deploying malicious pipelines, supporting Azure DevOps, GitHub, and GitLab.
Nord Stream is a command-line tool that extracts secrets stored in CI/CD environments by deploying malicious pipelines. It targets Azure DevOps, GitHub Actions, and GitLab CI to demonstrate how attackers can exploit misconfigured or vulnerable continuous integration systems to access sensitive credentials, tokens, and configuration data.
Security researchers, penetration testers, and red team operators who need to assess the security of CI/CD pipelines in organizations using Azure DevOps, GitHub, or GitLab.
Nord Stream provides a specialized, automated approach to CI/CD secret extraction that supports multiple platforms, bypasses common protections, and includes features like OIDC token theft, making it a comprehensive tool for security assessments.
Nord Stream is a tool that allows you to extract secrets stored inside CI/CD environments by deploying malicious pipelines. It currently supports Azure DevOps, GitHub and GitLab.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Covers Azure DevOps, GitHub Actions, and GitLab CI, allowing security assessments across the most common CI/CD providers without switching tools.
Includes OIDC token extraction for Azure and AWS, plus branch protection bypass, enabling simulation of sophisticated real-world attacks.
Allows deployment of arbitrary YAML pipelines via the --yaml option, so users can tailor exploits to specific environments or test custom scenarios.
Automatically cleans up pipeline logs post-exploitation (where possible), reducing detection risk during security engagements, as shown in the log cleanup examples.
Lacks support for Jenkins and Bitbucket, as admitted in the TODO list, making it less useful for organizations with diverse CI/CD systems.
Features like SSH service connection extraction require manual path adjustments on self-hosted runners, adding complexity and potential for errors.
For GitLab, the README explicitly states some traces cannot be deleted, leaving evidence that could compromise stealth in red team operations.
Requires git and GPG setup for full functionality (e.g., commit signing), adding extra installation and configuration steps beyond the core tool.