CICD-Goat VAPT Writeup

A full vulnerability assessment & penetration test against OWASP CICD-Goat — a deliberately vulnerable CI/CD environment (Jenkins, Gitea, GitLab, CTFd) — mapped end-to-end against the OWASP Top 10 CI/CD Security Risks.

Why this exists

Most CI/CD security writeups either stay purely theoretical (a slide explaining "poisoned pipeline execution") or purely CTF-flag-chasing (a one-line "here's the flag, next"). This repo tries to do neither: every finding below is a fully validated, PoC-backed vulnerability, mapped to a specific OWASP CI/CD-SEC risk category, written the way you'd actually want to explain it in an interview or a real client report — including the dead ends, the wrong assumptions, and how they got corrected.

If you're studying for an AppSec/DevSecOps/CI-CD-security interview, prepping for a pentest engagement involving a CI/CD toolchain, or just want a concrete, hands-on tour of what "Poisoned Pipeline Execution" or "Insufficient Credential Hygiene" actually looks like on the wire — this is written for you.

Target environment

Full rules of engagement: docs/00-engagement-overview.md.

⚠️ All testing in this repo was performed against the tester's own local, disposable, intentionally-vulnerable Docker Compose lab. No production systems, shared infrastructure, or third-party data were involved. Spin up your own copy of CICD-Goat from the official repo before trying any of this yourself.

Results at a glance

Plus 6 informational / supporting findings (positive controls, RBAC boundary confirmations, minor info-disclosure) in findings/informational/.

How the findings chain together

Several findings aren't independent — one directly enables or completes another. This is the part that tends to impress in an interview more than any single finding on its own:

9 of 11 CTFd challenges solved and flag-verified — see the full challenge cross-reference, including an honestly-documented case (Dormouse/flag9) where the access-control boundary held under sustained attack.

Full Table of Contents

Every file below is directly linked — the folder tree just shows how they're organized.

📋 Engagement Docs

🔍 Recon

🚨 Critical & High Findings

ℹ️ Informational / Supporting Findings

🎯 CTFd

Repo structure

.
├── docs/                          # Engagement context, methodology, mappings, remediation, interview prep
│   ├── 00-engagement-overview.md
│   ├── 01-methodology.md
│   ├── 02-owasp-top10-cicd-mapping.md
│   ├── 03-remediation-roadmap.md
│   ├── 04-interview-prep.md
│   └── 05-lessons-learned.md
├── recon/                         # Phase 1 & 2 — fingerprinting and authenticated enumeration
│   ├── 01-fingerprinting.md
│   └── 02-authenticated-enumeration.md
├── findings/                      # One file per confirmed finding, full PoC + remediation
│   ├── F-010-...md ... F-021-...md
│   └── informational/             # INFO/LOW severity supporting observations
├── ctfd/
│   └── challenge-cross-reference.md
└── LICENSE.md

Reading paths

• Just want the highlights? Start with the results table above, then read F-010, F-013, F-016, and F-017 — the four most complete end-to-end kill chains.
• Studying for an interview? Go straight to docs/04-interview-prep.md — one-paragraph, spoken-style summaries of every major finding, plus common follow-up questions.
• Building/hardening a CI/CD pipeline? Go straight to docs/03-remediation-roadmap.md — a prioritized, actionable checklist.
• New to CI/CD security concepts? Start with docs/02-owasp-top10-cicd-mapping.md for the reference taxonomy this whole repo is organized around.

About OWASP Top 10 CI/CD Security Risks

Every finding here is mapped against the OWASP Top 10 CI/CD Security Risks (2023) — a full reference table (CICD-SEC-1 through CICD-SEC-10) lives in docs/02-owasp-top10-cicd-mapping.md, since it's referenced constantly throughout the individual findings.

Disclaimer

This repository documents testing performed exclusively against a local, self-hosted, intentionally-vulnerable training lab (OWASP CICD-Goat), for educational and portfolio purposes. Nothing here targets, references, or was tested against any production system, third-party service, or real credential. Do not use any technique in this repo against systems you do not own or have explicit written authorization to test.

License

This content is licensed under CC BY 4.0. You're welcome to reuse or adapt any of this write-up — just give clear attribution to Dheeraj Kumar Jayaswal with a link back to this repository. CICD-Goat itself is a separate project by Cider Security — go star the original.

Part of a Broader Security Portfolio

🧠 Testing Philosophy

"The best security professionals think like developers first and attackers second. If you understand why systems are built the way they are, you will always find more than any scanner ever will."

I approach every engagement in three phases: understand before you attack (read the app, use it as a real user, learn the business logic first) → manual first, tools second (the interesting bugs are found by thinking, not scanning) → report like a developer (a finding the dev team can't reproduce is a finding that never gets fixed).

Author

• Name — Dheeraj Kumar Jayaswal
• Role — Technology Lead – Offensive Security, Infosys Limited
• Focus — Web Application & API Penetration Testing
• Domains — Income Tax · Banking · Retail · E-commerce · Freight Logistics · Education

🏅 Certifications

Future direction — Red Teaming: OSCP → CRTO → OSEP, CRTP, CRTL, CRTE

🌐 Connect

Feedback, corrections, and PRs (e.g. for flag9/Dormouse, or the Duchess/flag4 follow-up in the CTFd cross-reference) are welcome — see CONTRIBUTING.md.