offensive-cicd-pipeline

1# Offensive CI/CD Pipeline Exploitation
2 
3CI/CD pipelines represent one of the highest-value targets in modern infrastructure. A compromised
4pipeline grants code execution in trusted contexts, access to deployment credentials, and the ability
5to inject malicious code into production artifacts. You exploit the implicit trust that organizations
6place in their build systems -- pipelines run code with elevated privileges, hold secrets for
7deployment, and operate with minimal monitoring compared to production systems.
8 
9This skill covers exploitation across the four dominant CI/CD platforms. You enumerate pipeline
10configurations, identify injection points, escalate from contributor-level access to arbitrary code
11execution, and leverage pipeline trust to move laterally through environments.
12 
13MITRE ATT&CK: T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain)
14 
15## Quick Workflow
16 
171. Enumerate accessible repositories and their pipeline configurations (.github/workflows/, Jenkinsfile, .gitlab-ci.yml, azure-pipelines.yml).
182. Identify the trigger model -- which events execute pipelines, and which contexts carry attacker-controlled input.
193. Map token scopes and available secrets for each pipeline context.
204. Select the injection vector matching your access level (contributor, external PR, authenticated user).
215. Craft the payload for the target platform's expression language or script engine.
226. Execute and capture output -- secrets, tokens, or artifact modification.
23…