GitOops is a tool to help attackers and defenders identify lateral movement and privilege escalation paths in GitHub organizations by abusing CI/CD pipelines and GitHub access controls.
It works by mapping relationships between a GitHub organization and its CI/CD jobs and environment variables. It’ll use any Bolt-compatible graph database as backend, so you can query your attack paths with openCypher:
WHERE v.name =~ ".*SECRET.*"
GitOops takes inspiration from tools like Bloodhound and Cartography.
Check out the docs and more example queries.
If you like the site, please consider joining the telegram channel or supporting us on Patreon using the button below.