Mattia Brollo
Sessions
Modern software delivery runs on CI/CD pipelines and attackers know it. From the SolarWinds Orion backdoor to the Codecov Bash Uploader compromise and the countless exposed Jenkins instances found on Shodan, build systems have become one of the most valuable and least monitored targets in the software supply chain. A single misconfigured runner, an overprivileged token, or a poisoned dependency can silently compromise everything downstream; and the rise of AI-based attacking agents, capable of autonomously discovering and chaining misconfigurations at scale, is only raising the stakes.
This workshop is a practical introduction to CI/CD security through the lens of the OWASP Top 10 CI/CD Security Risks. We'll walk through each risk category (insufficient flow control, poisoned pipeline execution, dependency chain abuse, exposed secrets, insecure system configuration, and more) grounding each one in real-world incidents that made these risks tangible rather than theoretical.
After the theory, attendees get their hands dirty with a set of self-contained challenges built on the CICD Goat vulnerable-by-design environment, hunting for and exploiting common pipeline misconfigurations and attack chains, followed by a guided walkthrough of each solution.
Prerequisites: basic web/Linux exploitation knowledge, familiarity with git, and a laptop with Docker and a git client installed.
Reserve your time to solve the remaining challenges of the workshop held on Friday and join Meethack as we walk through the solutions.
📍 Meethack stand
Didn't finish on Friday? Come back, pick up where you left off, and see how it's done. See you there!