Migrate to using mdbook

src/pentesting-ci-cd/travisci-security/README.md

@@ -0,0 +1,65 @@
+# TravisCI Security
+
+{{#include ../../banners/hacktricks-training.md}}
+
+## What is TravisCI
+
+**Travis CI** is a **hosted** or on **premises** **continuous integration** service used to build and test software projects hosted on several **different git platform**.
+
+{{#ref}}
+basic-travisci-information.md
+{{#endref}}
+
+## Attacks
+
+### Triggers
+
+To launch an attack you first need to know how to trigger a build. By default TravisCI will **trigger a build on pushes and pull requests**:
+
+![](<../../images/image (145).png>)
+
+#### Cron Jobs
+
+If you have access to the web application you can **set crons to run the build**, this could be useful for persistence or to trigger a build:
+
+![](<../../images/image (243).png>)
+
+> [!NOTE]
+> It looks like It's not possible to set crons inside the `.travis.yml` according to [this](https://github.com/travis-ci/travis-ci/issues/9162).
+
+### Third Party PR
+
+TravisCI by default disables sharing env variables with PRs coming from third parties, but someone might enable it and then you could create PRs to the repo and exfiltrate the secrets:
+
+![](<../../images/image (208).png>)
+
+### Dumping Secrets
+
+As explained in the [**basic information**](basic-travisci-information.md) page, there are 2 types of secrets. **Environment Variables secrets** (which are listed in the web page) and **custom encrypted secrets**, which are stored inside the `.travis.yml` file as base64 (note that both as stored encrypted will end as env variables in the final machines).
+
+- To **enumerate secrets** configured as **Environment Variables** go to the **settings** of the **project** and check the list. However, note that all the project env variables set here will appear when triggering a build.
+- To enumerate the **custom encrypted secrets** the best you can do is to **check the `.travis.yml` file**.
+- To **enumerate encrypted files** you can check for **`.enc` files** in the repo, for lines similar to `openssl aes-256-cbc -K $encrypted_355e94ba1091_key -iv $encrypted_355e94ba1091_iv -in super_secret.txt.enc -out super_secret.txt -d` in the config file, or for **encrypted iv and keys** in the **Environment Variables** such as:
+
+![](<../../images/image (81).png>)
+
+### TODO:
+
+- Example build with reverse shell running on Windows/Mac/Linux
+- Example build leaking the env base64 encoded in the logs
+
+### TravisCI Enterprise
+
+If an attacker ends in an environment which uses **TravisCI enterprise** (more info about what this is in the [**basic information**](basic-travisci-information.md#travisci-enterprise)), he will be able to **trigger builds in the the Worker.** This means that an attacker will be able to move laterally to that server from which he could be able to:
+
+- escape to the host?
+- compromise kubernetes?
+- compromise other machines running in the same network?
+- compromise new cloud credentials?
+
+## References
+
+- [https://docs.travis-ci.com/user/encrypting-files/](https://docs.travis-ci.com/user/encrypting-files/)
+- [https://docs.travis-ci.com/user/best-practices-security](https://docs.travis-ci.com/user/best-practices-security)
+
+{{#include ../../banners/hacktricks-training.md}}

src/pentesting-ci-cd/travisci-security/basic-travisci-information.md

@@ -0,0 +1,92 @@
+# Basic TravisCI Information
+
+{{#include ../../banners/hacktricks-training.md}}
+
+## Access
+
+TravisCI directly integrates with different git platforms such as Github, Bitbucket, Assembla, and Gitlab. It will ask the user to give TravisCI permissions to access the repos he wants to integrate with TravisCI.
+
+For example, in Github it will ask for the following permissions:
+
+- `user:email` (read-only)
+- `read:org` (read-only)
+- `repo`: Grants read and write access to code, commit statuses, collaborators, and deployment statuses for public and private repositories and organizations.
+
+## Encrypted Secrets
+
+### Environment Variables
+
+In TravisCI, as in other CI platforms, it's possible to **save at repo level secrets** that will be saved encrypted and be **decrypted and push in the environment variable** of the machine executing the build.
+
+![](<../../images/image (203).png>)
+
+It's possible to indicate the **branches to which the secrets are going to be available** (by default all) and also if TravisCI **should hide its value** if it appears **in the logs** (by default it will).
+
+### Custom Encrypted Secrets
+
+For **each repo** TravisCI generates an **RSA keypair**, **keeps** the **private** one, and makes the repository’s **public key available** to those who have **access** to the repository.
+
+You can access the public key of one repo with:
+
+```
+travis pubkey -r <owner>/<repo_name>
+travis pubkey -r carlospolop/t-ci-test
+```
+
+Then, you can use this setup to **encrypt secrets and add them to your `.travis.yaml`**. The secrets will be **decrypted when the build is run** and accessible in the **environment variables**.
+
+![](<../../images/image (139).png>)
+
+Note that the secrets encrypted this way won't appear listed in the environmental variables of the settings.
+
+### Custom Encrypted Files
+
+Same way as before, TravisCI also allows to **encrypt files and then decrypt them during the build**:
+
+```
+travis encrypt-file super_secret.txt -r carlospolop/t-ci-test
+
+encrypting super_secret.txt for carlospolop/t-ci-test
+storing result as super_secret.txt.enc
+storing secure env variables for decryption
+
+Please add the following to your build script (before_install stage in your .travis.yml, for instance):
+
+    openssl aes-256-cbc -K $encrypted_355e94ba1091_key -iv $encrypted_355e94ba1091_iv -in super_secret.txt.enc -out super_secret.txt -d
+
+Pro Tip: You can add it automatically by running with --add.
+
+Make sure to add super_secret.txt.enc to the git repository.
+Make sure not to add super_secret.txt to the git repository.
+Commit all changes to your .travis.yml.
+```
+
+Note that when encrypting a file 2 Env Variables will be configured inside the repo such as:
+
+![](<../../images/image (170).png>)
+
+## TravisCI Enterprise
+
+Travis CI Enterprise is an **on-prem version of Travis CI**, which you can deploy **in your infrastructure**. Think of the ‘server’ version of Travis CI. Using Travis CI allows you to enable an easy-to-use Continuous Integration/Continuous Deployment (CI/CD) system in an environment, which you can configure and secure as you want to.
+
+**Travis CI Enterprise consists of two major parts:**
+
+1. TCI **services** (or TCI Core Services), responsible for integration with version control systems, authorizing builds, scheduling build jobs, etc.
+2. TCI **Worker** and build environment images (also called OS images).
+
+**TCI Core services require the following:**
+
+1. A **PostgreSQL11** (or later) database.
+2. An infrastructure to deploy a Kubernetes cluster; it can be deployed in a server cluster or in a single machine if required
+3. Depending on your setup, you may want to deploy and configure some of the components on your own, e.g., RabbitMQ - see the [Setting up Travis CI Enterprise](https://docs.travis-ci.com/user/enterprise/tcie-3.x-setting-up-travis-ci-enterprise/) for more details.
+
+**TCI Worker requires the following:**
+
+1. An infrastructure where a docker image containing the **Worker and a linked build image can be deployed**.
+2. Connectivity to certain Travis CI Core Services components - see the [Setting Up Worker](https://docs.travis-ci.com/user/enterprise/setting-up-worker/) for more details.
+
+The amount of deployed TCI Worker and build environment OS images will determine the total concurrent capacity of Travis CI Enterprise deployment in your infrastructure.
+
+![](<../../images/image (199).png>)
+
+{{#include ../../banners/hacktricks-training.md}}