cicd-goat
cider-security-research/cicd-goatA deliberately vulnerable CI/CD environment. Learn CI/CD security through multiple challenges.
ctfdevsecopseducation+3
2.3k
cider-security-research/cicd-goatA deliberately vulnerable CI/CD environment. Learn CI/CD security through multiple challenges.
commando-x/vuln-bankIntentionally vulnerable banking platform for practicing web application, API, and AI/LLM security testing, secure code review, and DevSecOps…
c00ln3t/log4shellauditorAn autonomous reflective Go agent for full-cycle security auditing, WAF evasion, OOB LDAP verification, self-remediation (auto-patching), and…
promptfoo/promptfooTest your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and…
synacktiv/nord-streamNord Stream is a tool that allows you to extract secrets stored inside CI/CD environments by deploying malicious pipelines. It currently supports…
synacktiv/gh-hijack-runnerA python script to create a fake GitHub runner and hijack pipeline jobs to leak CI/CD secrets.
dheeraj-jayaswal/cicd-goat-vapt-writeupFull VAPT writeup of OWASP CICD-Goat — 9 CTFd flags captured, 4 critical + 5 high findings (incl. CVE-2024-23897) mapped to the OWASP Top 10 CI/CD…
mobsf/mobile-security-framework-mobsfAutomated mobile application security testing framework for Android, iOS, and Windows. Performs static and dynamic analysis, malware detection, and…
hacktricks-wiki/hacktricks-cloudCommunity-driven knowledge base for pentesting cloud environments and CI/CD pipelines: attack techniques, enumeration, privilege escalation, and…
traceforce/mcp-xrayUnified security scanner for MCP servers with config, pentest, and repo-scan modes. Generates SARIF reports for CI/CD integration, detects secrets,…
wavestone-cdt/defcon-cicd-pipelines-workshopHands-on CI/CD pipeline security workshop with Terraform lab, AWS exploitation, Kubernetes escape, and artifact backdooring exercises for offensive…
h4wkst3r/dop2mopOpenGraph collector for BloodHound that maps attack paths from DevOps to MLOps infrastructure, collecting CI/CD pipeline, service principal, and ML…
mrk336/from-foothold-to-domain-admin-weaponizing-cve-2025-54918-in-real-world-devopsSimulated exploitation and mitigation of CVE-2025-54918 (Windows NTLM flaw). Includes detection scripts, Ansible patching, and CI/CD hardening.…
mrk336/cve-2025-27480CVE-2025-27480 exposes a buffer overflow in OpenSSH 8.9p1 via a malformed SSH_USERAUTH packet. Attackers can inject shellcode and gain SYSTEM-level…
ericmtzmtz/pwnproxyAn open, local-first security testing platform for pentesters, AI agents, CI/CD pipelines, and teams.
rodhnin/pythia-sql-clairvoyanceAdvanced SQL Injection Scanner with AI-powered analysis, ethical compliance framework, and professional reporting.