Workshop: CI/CD Exploitation and Hardening

This hands-on workshop teaches both offensive exploitation and defensive hardening of CI/CD pipelines. Students build pipelines using GitHub Actions and GitLab CI while learning how attackers exploit misconfigurations such as secret exposure and insecure workflows.

The course emphasizes attacker mindset within the software supply chain. Students will explore techniques like environment variable exfiltration, script injection, and runner lateral movement, followed by defensive mitigation strategies.

The workshop progresses into DevSecOps practices including SAST, dependency scanning, container scanning, and egress monitoring. It concludes with a multi-stage GitLab CI/CD attack chain and a capstone project building a secure pipeline.