IadRabbit
Sessions
Modern software delivery runs on CI/CD pipelines and attackers know it. From the SolarWinds Orion backdoor to the Codecov Bash Uploader compromise and the countless exposed Jenkins instances found on Shodan, build systems have become one of the most valuable and least monitored targets in the software supply chain. A single misconfigured runner, an overprivileged token, or a poisoned dependency can silently compromise everything downstream; and the rise of AI-based attacking agents, capable of autonomously discovering and chaining misconfigurations at scale, is only raising the stakes.
This workshop is a practical introduction to CI/CD security through the lens of the OWASP Top 10 CI/CD Security Risks. We'll walk through each risk category (insufficient flow control, poisoned pipeline execution, dependency chain abuse, exposed secrets, insecure system configuration, and more) grounding each one in real-world incidents that made these risks tangible rather than theoretical.
After the theory, attendees get their hands dirty with a set of self-contained challenges built on the CICD Goat vulnerable-by-design environment, hunting for and exploiting common pipeline misconfigurations and attack chains, followed by a guided walkthrough of each solution.
Prerequisites: basic web/Linux exploitation knowledge, familiarity with git, and a laptop with Docker and a git client installed.
Join the Meethack community for a hands-on NFC CTF challenge based on the Mifare Classic 1K chip! All you need is an Android device with NFC — no root required.
We'll open with a short introduction to the chip's specs, then the challenge goes live.
🎫 Reserve your NFC badge (limited availability): https://forms.gle/3UJ9PnwUTj2NzEm98
(No badge? Bring your own — that works too.)
📍 Meethack stand
Reserve your time to solve the remaining challenges of the workshop held on Friday and join Meethack as we walk through the solutions.
📍 Meethack stand
Didn't finish on Friday? Come back, pick up where you left off, and see how it's done. See you there!
Couldn't crack the Mifare Classic 1K challenge, or just curious how it's done? Join Meethack as we walk through the solution to the NFC CTF launched on Friday.
📍 Meethack stand
The full write-up will also be posted afterwards in the Telegram group.
See you there!