c0c0n @2025 | Hacking & Cyber Security Briefing

WORKSHOP OBJECTIVE

This hands-on workshop focuses on real-world attacks and misconfiguration audits of cloud-native CI/CD systems like GitHub Actions, GitLab CI, and Bitbucket Pipelines. As organizations increasingly shift toward SaaS-based development infrastructures, CI/CD pipelines have become a prime target for attackers and a blind spot for defenders. Rapid adoption of these technologies has meant that a lot of the security precautions are thrown out of the window and insecure by default settings are in place.

This course equips attendees with both offensive and auditing skills. This enables them to compromise vulnerable pipelines, identify security misconfigurations, and understand how to harden their DevOps infrastructure. The training progresses from pipeline setup and exploitation to detection, auditing of pipeline design

PRE-REQUISITE

The course assumes basic familiarity with CI CD and pipeline concepts. Security tooling and specific pipeline details will be covered in the course.

PARTICIPANT'S REQUIREMENTS

Our labs are cloud-based, and a browser should be sufficient. However, we will still suggest the following hardware specs
Laptop with working browser and unrestricted internet access (at least port 80 and 443. However, some web-socket connections might be required.)
We would still recommend bringing a laptop with full administrative access in case any troubleshooting is required
As part of the program, participants will need existing free accounts on platforms like GitHub, Gitlab and Bitbucket for hands-on activities. Clear instructions will be provided in advance, and creating these accounts is free of charge. fresh account (less then 30 days old) have limitations in environment for maximum absorption of content its recommended to create an id and ensure its older then 30 days when you attend the class.

WHO SHOULD ATTEND

Pentester
Security engineer
Red team testers
Product security engineers
DevOps engineers

WHAT TO EXPECT

Streamlined begineer to intermediate knowledge enhancement coupled with realistic challenge of CI CD Environments

WHAT NOT TO EXPECT

Don't expect to be hero from zero. we are here to support your journey and provide you enough guidance and resources that you are able to climb the ladder faster

DURATION

Duration: 3 days

Trainer

Anant Shrivastava

Founder, Cyfinoid Research

Training Plan

Understanding CI/CD in the Cloud-Native Era
- Definition and importance of CI/CD
- Key components of CI/CD pipelines:
  - Source control
  - Build automation
  - Testing
  - Deployment
  - Monitoring
- CI/CD in the Software Development Life Cycle (SDLC)
- Evolution from self-hosted to SaaS CI/CD platforms
- Threat modeling CI/CD workflows
- Overview of GitHub Actions, GitLab CI, Bitbucket Pipelines
Setting Up a Baseline CI/CD Pipeline
- Free-tier setup across GitHub, GitLab, and Bitbucket
- Hands-on build + deploy pipeline creation
Breaking the Build (Attacking Pipelines)
- Pull request poisoning & untrusted workflow
- Token misuse and secret leakage
- Public action/package abuse
- Artifact injection & malicious workflow chaining
Privilege Escalation & Persistence
- Abuse of pipeline contexts and permissions
- Escalating to org-level access
- Backdooring via pipeline logic manipulation
Auditing and Detection
- Automated Auditing of CI Environments
- Manual audits via APIs
- Creating a lightweight audit checklis
- Interpreting and remediating real-world misconfigs
Secure CI/CD Tips and Discussion
- Reducing attack surface
- Token scoping and context control
- Hardening secrets, logs, and artifact storage
- Role-based access and branch protections
Capture-the-Flag
- Exploit an array of pre deployed CI environments and extract the flag

Contact Info

Social Links

WS-12

Attacking CI CD Environments

07-09 October, 2025