Modern organizations have handed the keys to their production infrastructure to YAML files. CI/CD pipelines hold credentials for every cloud account, can deploy to production on every merge, and execute code contributed by anyone with repository access. They are the most privileged systems in the environment, and they are systematically undertested by security teams.
Attacking CI/CD requires a different mindset than traditional intrusion. There is no network perimeter to breach: the entry point is a pull request, a workflow trigger, or an exposed runner registration token. From there, attackers pivot through expression injections, artifact poisoning, self-hosted runner hijacking, and OIDC token abuse to reach cloud credentials, production secrets, and the organization's entire software supply chain.
This two-day training covers offensive techniques against the two most widely deployed CI/CD platforms: GitHub and GitLab. Day 1 focuses on GitHub Actions internals, untrusted input injection, Dependabot abuse, repo jacking, self-hosted runner hijacking, and OIDC claim exploitation. Day 2 covers GitLab pipeline configuration abuse, runner execution mode exploitation (Shell, Docker, Kubernetes), Docker-in-Docker breakout, runner identity theft, and post-exploitation through the Ruby console and direct filesystem access. The course is built on years of original published research by the trainers, and includes two purpose-built offensive tools developed at Synacktiv: octoscan for static pipeline vulnerability analysis, and nord-stream for automated secret extraction across CI/CD platforms.
Labs span both days as a continuous realistic kill chain, running against dedicated environments simulating complex GitHub and GitLab organizations. Participants progress from unauthenticated repository reconnaissance through pipeline injection, runner compromise, advanced secret extraction, and cloud pivoting.
