Merge pull request #51 from kitctf/add/github-insecure-actions-talk

Add insecure GitHub Actions talk
kitctf · Nov 2, 2023 · 353a922 · 353a922
2 parents 898f7da + 2beb58b
commit 353a922
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 0 deletions.
diff --git a/_posts/2023-11-02-insecure-github-actions.md b/_posts/2023-11-02-insecure-github-actions.md
@@ -0,0 +1,16 @@
+---
+layout: post
+title: "Talk: Insecure GitHub Actions"
+categories: learning
+author: intrigus
+---
+
+You know GitHub Actions, these small building blocks that make your dev life easier… But they can also get you pwned in no time, if you are not careful.
+
+The talk covers:
+* the basic structure of a GitHub Actions workflow.
+* the general permission model of GitHub Actions.
+* insecure templating and executing user-controlled code in privileged workflows.
+* cache poisoning in workflows.
+
+The slides can be found [here](/talks/2023-10-26-insecure-github-actions/insecure-github-actions.pdf). The workshop was held on 2023-10-26.
diff --git a/talks/2023-10-26-insecure-github-actions/insecure-github-actions.pdf b/talks/2023-10-26-insecure-github-actions/insecure-github-actions.pdf