GitHub Actions Attack Diagram Logo

GitHub Actions Attack Diagram

0
Free
Visit Website

The GitHub Actions Attack Diagram is a visual guide for identifying and exploiting vulnerabilities in GitHub Actions configurations. It outlines various attack paths, starting from read-only or write access to a GitHub organization or repository. The diagram covers multiple attack vectors, including: 1. Self-hosted runner takeover 2. PWN requests 3. Secrets exfiltration It provides links to additional resources for context and is based on real-world red team engagements and public vulnerability research. The diagram focuses on major attack paths and Tactics, Techniques, and Procedures (TTPs) that have been successfully used in live environments. While not exhaustive, the tool serves as a reference for security professionals to understand and mitigate potential risks in GitHub Actions workflows. It also includes references to related research presentations and blog posts detailing real-world exploits of CI/CD vulnerabilities.

FEATURES

ALTERNATIVES

Python framework for building and utilizing interfaces to transfer data between frameworks with a focus on Command and Control frameworks.

An open-source shellcode and PE packer for creating and managing portable executable files.

A powerful enumeration tool for discovering assets and subdomains.

High-performant, coroutines-driven, and fully customisable Low & Slow load generator for real-world pentesting with undetectability through Tor.

The Proxmark III is a versatile device for sniffing, reading, and cloning RFID tags with strong community support.

A week-long series of articles and talks on evading Microsoft Advanced Threat Analytics (ATA) detection

A black-box obfuscation tool for Android apps with Android App Bundle support.

Collection of Return-Oriented Programming challenges for practicing exploitation skills.