CI/CD Pipeline Poisoning Kit

CI/CD Pipeline Poisoning Kit

Técnicas de ataque contra pipelines de integración continua:

• GitHub Actions — Injection via pull_request_target, workflow_run abuse, GITHUB_TOKEN scope escalation, artifact poisoning.
• GitLab CI — Variable extraction, shared runner abuse, include directive injection, cache poisoning.
• Jenkins — Groovy script console abuse, credential extraction via pipeline, shared library injection.
• General — Dependency confusion attacks, build artifact tampering, secret extraction from build logs.
• Detection — Scripts para detectar si un pipeline es vulnerable a cada técnica antes de explotar.