Modern organizations have handed the keys to their production infrastructure to YAML files. CI/CD pipelines hold credentials for every cloud account, can deploy to production on every merge, and execute code contributed by anyone with repository access. They are the most privileged systems in the environment, and they are systematically undertested by security teams.
Attacking CI/CD requires a different mindset than traditional intrusion. There is no network perimeter to breach: the entry point is a pull request, a workflow trigger, or an exposed runner registration token. From there, attackers pivot through expression injections, artifact poisoning, self-hosted runner hijacking, and OIDC token abuse to reach cloud credentials, production secrets, and the organization's entire software supply chain.
This two-day training covers offensive techniques against the two most widely deployed CI/CD platforms: GitHub and GitLab. Day 1 focuses on GitHub Actions internals, untrusted input injection, Dependabot abuse, repo jacking, self-hosted runner hijacking, and OIDC claim exploitation. Day 2 covers GitLab pipeline configuration abuse, runner execution mode exploitation (Shell, Docker, Kubernetes), Docker-in-Docker breakout, runner identity theft, and post-exploitation through the Ruby console and direct filesystem access. The course is built on years of original published research by the trainers, and includes two purpose-built offensive tools developed at Synacktiv: octoscan for static pipeline vulnerability analysis, and nord-stream for automated secret extraction across CI/CD platforms.
Labs span both days as a continuous realistic kill chain, running against dedicated environments simulating complex GitHub and GitLab organizations. Participants progress from unauthenticated repository reconnaissance through pipeline injection, runner compromise, advanced secret extraction, and cloud pivoting.
Course Level
Intermediate
Course Requirements
A laptop capable of running a virtual machine with at least 4GB RAM and 2 vCPUs.
Key takeaways
Participants will be able to:
- Map the attack surface of GitHub Actions and GitLab CI/CD pipelines: workflow triggers, variable stores, protected branches, OIDC integrations, and runner configurations
- Exploit untrusted inputs, expression injections, and dangerous artifact patterns to execute arbitrary code within pipelines
- Abuse supply chain vectors including Dependabot and repository jacking to introduce malicious code into target organizations
- Hijack GitHub and GitLab self-hosted runners through registration token theft, persistence mechanisms, and runner identity takeover
- Exploit weak OIDC claim bindings to obtain cloud credentials (AWS, GCP, Azure) directly from pipeline tokens without touching a single secret
- Conduct GitLab post-exploitation via the Ruby console, direct filesystem repository access, and Docker-in-Docker breakout
- Extract secrets from CI/CD environments at scale using `nord-stream` and discover pipeline vulnerabilities with `octoscan`
