CI/CD attack paths and their defence
You watch attacks such as poisoned pipeline execution, cache poisoning and artefact tampering step by step in your own isolated lab and set up controls that detect and prevent each one.
Level 401 · 13 lessons · 12 practice labs
Lessons
Trust in the pipeline
- The pipeline trust model: who can run code
- Untrusted triggers: outside contributions and comment triggers
- Short task: classify a repository’s triggers by trust level
Attacks
- Poisoned pipeline execution: direct and indirect
- Command injection from variables: branch names and titles
- Cache poisoning
- Artefact tampering and trust between stages
- Takeover of a persistent runner
- Short task: find and fix two injection points in a pipeline file
Detection and response
- Hunting suspicious behaviour in pipeline logs
- Detecting token abuse
- Responding to a compromised pipeline: tokens, artefacts, releases
- Capstone: verify and close a pipeline’s attack paths through an exercise
Practice labs
- Classify a repository’s triggers by trust level: Label the triggers in the pipeline file as trusted, semi-trusted or untrusted.
- Work out who can run code in the pipeline: Examine role, branch and outside contribution settings and tabulate everyone able to run code in the pipeline and the secrets they can reach.
- Secure a comment-triggered job against untrusted input: Show from the configuration that an outside contribution can start a privileged job by comment, split it behind approval and an unprivileged environment and test the setting.
- Mark where variables go straight into commands in a pipeline file: List the places where user-controlled variables such as branch name, title and commit message are used in a shell line.
- Find and fix two injection points in a pipeline file: Make the command safe by quoting the variable and passing it through the environment, and test it in your own lab with a branch name containing special characters.
- Close an indirect poisoned pipeline execution path: Find that the pipeline runs a script and a build file from an unprotected branch, require review for those files and restrict the job with secrets to the protected branch.
- Map the pipeline’s use of caches and artefacts: Tabulate which job produces and consumes which cache key and artefact.
- Separate the cache by trust level: Show feature branches can write to the main branch’s cache, split the key for protected and unprotected branches and verify.
- Verify artefact integrity between stages and retire the persistent runner: Sign the digest at build, verify it at deploy, show an altered artefact is refused and replace the shared persistent runner with an ephemeral one.
- Find unusual runs in the pipeline logs: List runs triggered out of hours, from unusual branches and reading variables.
- Write a query that detects token abuse: Catch from the audit logs a job token used from an address other than the runner and after the job ended.
- Respond to a compromised pipeline and verify the paths through an exercise: Revoke tokens, quarantine suspect artefacts and releases, rebuild in a clean environment and show in your own lab that each closed path no longer works.
About this course
You watch attacks such as poisoned pipeline execution, cache poisoning and artefact tampering step by step in your own isolated lab and set up controls that detect and prevent each one.
What you will learn
- Trust in the pipeline
- Attacks
- Detection and response
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.