CI/CD & Supply Chain Security
The software supply chain is the new frontier of offensive security. A single compromised build pipeline can grant access to thousands of downstream targets. This guide covers exploitation, defense, and industry frameworks across 12 sections.
High-Impact Attack Surface
Frameworks Covered
Assessment Tiers
TIER 1 — Developer
First-time CI/CD security assessment
- • GitHub Actions basics
- • Secrets scanning
- • IaC security
TIER 2 — Platform Engineer
Enterprise pipeline security
- • Jenkins/GitLab exploitation
- • OIDC federation attacks
- • Container registries & GitOps
TIER 3 — Red Team / Supply Chain
Advanced supply chain operations
- • Dependency poisoning
- • SLSA & provenance bypasses
- • AI/ML pipeline attacks
What You'll Learn
Prerequisites
CI/CD Foundations
- • Git fundamentals (branches, PRs)
- • YAML pipeline syntax
- • Docker basics
Offensive Skills
- • Command injection
- • Token/credential abuse
- • API enumeration
Recommended Context
Attack Surface Overview
Key Attack Techniques
🔓 Secret Extraction
Dumping CI/CD environment variables, stealing API keys, cloud credentials, and tokens from build logs.
💉 Pipeline Injection
Modifying build configs to execute arbitrary code during CI/CD runs (workflow files, Jenkinsfiles).
🏃 Runner Compromise
Attacking self-hosted runners for persistence, lateral movement into internal networks.
📦 Dependency Attacks
Typosquatting, dependency confusion, and package hijacking on NPM/PyPI/etc.
Learning Modules
GitHub Actions
Exploiting workflow misconfigurations, secret leakage, and runner attacks.
Jenkins & GitLab
Attacking CI/CD pipelines, Groovy script console, and runner abuse.
Dependency Poisoning
Supply chain attacks via NPM, PyPI, and internal package registries.
OIDC & Cloud CI/CD
Exploiting OIDC federation to steal AWS, GCP, and Azure credentials.
Container Registry
Poisoning Docker images, registry hijacking, and base image attacks.
Secrets Scanning
Finding leaked credentials in repos, logs, and artifacts.
Azure DevOps
Exploiting Azure Pipelines, variable groups, and service connections.
GitOps & ArgoCD
Attacking GitOps workflows for automatic K8s deployment of backdoors.
IaC & Terraform
State file secrets, malicious modules, and provisioner RCE.
OWASP CI/CD Top 10 & SLSA
Industry frameworks for CI/CD risk classification and supply chain integrity.
Sigstore, SBOMs & Attestation
Software signing, provenance verification, and bill of materials.
AI/ML Pipeline Security
Model poisoning, MLOps attacks, and Jupyter notebook injection.
Real-World Supply Chain Attacks
These aren't theoretical. Study them.
| Attack | Impact | Technique |
|---|---|---|
| SolarWinds (2020) | 18,000+ organizations | Build system compromise, backdoor injection |
| Codecov (2021) | 29,000+ customers | Bash uploader script modified to exfiltrate env vars |
| ua-parser-js (2021) | 7M weekly downloads | NPM account takeover, crypto miner injection |
| Log4Shell (2021) | Millions of apps | Dependency vulnerability (transitive supply chain) |
| PyTorch (2022) | ML community | Dependency confusion on torchtriton |
| CircleCI (2023) | All customers | Session token theft, secrets exposed |
| 3CX (2023) | 600K+ organizations | Compromised build env via Trading Technologies |
| xz-utils (2024) | Linux infrastructure | Multi-year social engineering, backdoor in build |
Quick Recon
find . -path "*/.github/workflows/*.yml" -o -path "*/.github/workflows/*.yaml"trufflehog git https://github.com/target/repo --only-verifiednpm pack <package> && tar -xzf *.tgz && cat package/package.json | jq '.scripts'Essential Resources
OWASP Top 10 CI/CD Risks
Industry standard framework for CI/CD security.
SLSA Framework
Supply-chain Levels for Software Artifacts.
Related Topics
Cloud Pentesting
CI/CD pipelines often have cloud credentials and OIDC federation.
Container Security
Docker and Kubernetes attacks pair with registry exploitation.
Web Pentesting
Deploy backdoors via compromised pipelines to web applications.
Threat & Risk Assessment
Assess supply chain risk with FAIR quantification.
Secure Architecture
Secure-by-design CI/CD pipeline patterns.