m3ssap0
Hey, I'm m3ssap0! I do AppSec stuff - mostly web, I work as a Security Engineering Manager and I organize Meethack meetups in Torino every week. Some years ago, I used to play CTFs. Now I am a beginner carnivore plants and terrariums grower.
Session
Modern software delivery runs on CI/CD pipelines and attackers know it. From the SolarWinds Orion backdoor to the Codecov Bash Uploader compromise and the countless exposed Jenkins instances found on Shodan, build systems have become one of the most valuable and least monitored targets in the software supply chain. A single misconfigured runner, an overprivileged token, or a poisoned dependency can silently compromise everything downstream; and the rise of AI-based attacking agents, capable of autonomously discovering and chaining misconfigurations at scale, is only raising the stakes.
This workshop is a practical introduction to CI/CD security through the lens of the OWASP Top 10 CI/CD Security Risks. We'll walk through each risk category (insufficient flow control, poisoned pipeline execution, dependency chain abuse, exposed secrets, insecure system configuration, and more) grounding each one in real-world incidents that made these risks tangible rather than theoretical.
After the theory, attendees get their hands dirty with a set of self-contained challenges built on the CICD Goat vulnerable-by-design environment, hunting for and exploiting common pipeline misconfigurations and attack chains, followed by a guided walkthrough of each solution.
Prerequisites: basic web/Linux exploitation knowledge, familiarity with git, and a laptop with Docker and a git client installed.