CI/CD Attacks
88 items from tupletype/awesome-cicd-attacks ★635
-
zizmorcore/zizmor github.com
[zizmor] - Static analysis tool for GitHub Actions that finds security issues including template injection, credential leakage, excessive permissions, and impostor commits.
-
-
-
Secrets Patterns Database github.com
The largest open-source database for detecting secrets, API keys, passwords, tokens, and more.
-
-
Common Threat Matrix for CI/CD Pipeline github.com
-
-
Jenkins Attack Framework github.com
This tool can manage Jenkins tasks, like listing jobs, dumping credentials, running commands/scripts, and managing API tokens.
-
-
-
GitHub Actions Attack Diagram github.com
Includes public vulnerability research presented at Black Hat USA 2024 and DEF CON 32.
-
SDLC Infrastructure Threat Framework (SITF) github.com
A comprehensive framework for analyzing and defending against attacks targeting Software Development Life Cycle Infrastructure.
-
Living off the pipeline github.com
Inventory how development tools (typically CLIs), have lesser-known RCE-By-Design features.
-
GitLab Secrets github.com
A tool that can reveal deleted GitLab commits that potentially contain sensitive information and are not accessible via the public Git history.
-
ActionsTOCTOU (Time Of Check to Time Of Use) github.com
A tool to monitor for an approval event and then quickly replace a file in the PR head with a local file specified as a parameter.
-
-
