CI/CD Goat
The CI/CD Goat project allows engineers and security practitioners to learn and practice CI/CD security through a set of 11 challenges, enacted against a real, full blown CI/CD environment. The scenarios are of varying difficulty levels, with each scenario focusing on one primary attack vector. The challenges cover the Top 10 CI/CD Security Risks, including Insufficient Flow Control Mechanisms, PPE (Poisoned Pipeline Execution), Dependency Chain Abuse, PBAC (Pipeline-Based Access Controls), and more. The different challenges are inspired by Alice in Wonderland, each one is themed as a different character. The project’s environment is based on Docker containers and can be run locally. These containers are: Gitea (minimal git server), Jenkins, Jenkins agent, LocalStack (cloud service emulator that runs in a single container), and Prod (contains Docker in Docker and Lighttpd service).
FEATURES
SIMILAR TOOLS
A comprehensive guide to Nessus, a vulnerability scanner, covering data directories, binary directories, logs directories, plugin directories, advanced settings, API, and good practices.
INE Security offers a range of cybersecurity certifications, including penetration testing, mobile and web application security, and incident response.
A network of physical and online cyber warfare ranges for training and testing
An annual jeopardy-style capture-the-flag contest with challenges related to cybersecurity.
A comprehensive guide to Python 3 syntax, features, and resources in a single image.
A repository of CTF challenges and resources from various cybersecurity competitions.
Comprehensive endpoint protection platform providing unified visibility and security for cloud workloads, endpoints, and containers.
PINNED
Mandos
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.