Gitoops

<dl> <h1> <div align=center>GitOops!</div> <div align=center>😱</div> </h1> <p align="center"><i>all paths lead to clouds</i></p> <br /> </dl>

GitOops is a tool to help attackers and defenders identify lateral movement and privilege escalation paths in GitHub organizations by abusing CI/CD pipelines and GitHub access controls.

It works by mapping relationships between a GitHub organization and its CI/CD jobs and environment variables. It'll use any Bolt-compatible graph database as backend, so you can query your attack paths with openCypher:

MATCH p=(:User{login:"alice"})-[*..5]->(v:EnvironmentVariable)
WHERE v.name =~ ".*SECRET.*"
RETURN p

<dl> <p align="center"> <img src="./docs/img/screenshot.png"> </p> </dl>

GitOops takes inspiration from tools like Bloodhound and Cartography.

Check out the docs, some more example queries and our BSides London talk.