In this post, we covered enumerating vulnerabilities in the DeVOps among which is the insecure file permissions. This was part of TryHackMe Advent of Cyber 3 Day 14.
In DevOps, CI/CD are two terms that will often come up when talking about software development and DevOps. Their definitions are pretty straightforward.
CI: Continuous Integration is the process in which software source code is kept in a central repository (such as GitHub). All changes are stored in this central repository to avoid ending up with different versions of the same code.
CD: Continuous Delivery is the following (sometimes integral) step of the continuous integration model where code is automatically deployed to the test, pre-production, or production environments. CD is sometimes used as an acronym for “Continuous Deployment”. If you feel like the terms above don’t seem to have clear limits, you are right. CI, CD, and the other CD are all part of DevOps best practices that aim to make code delivery faster and more reliable.
Get OSCP Certificate Notes
CI/CD should be considered as a set of practices that are put in place to enable development teams to make changes, test their code, and deploy the application more reliably. We should think of CI/CD as a continuous process or loop that includes steps of the software development process.
The CI/CD integration approach seems to be an effective way to mitigate risks that may result from manually aggregating changes made to the code, manually testing them, and manually deploying the updated version of the application. However, some risks associated with the CI/CD process should be taken into consideration when dealing with such an integration. As a penetration tester, one of our goals would be to uncover weaknesses in the automation process. These can vary from file permissions to configuration errors made when installing any CI/CD automation software. DevOps teams typically use software such as Jenkins, GitLab, Bamboo, AWS CodePipeline, etc., to automate CI/CD steps summarized above.
Task Answers
How many pages did the dirb scan find with its default wordlist?
4
How many scripts do you see in the /home/thegrinch/scripts folder?
4
What are the five characters following $6$G in pepper’s password hash?
ZUP42
What is the content of the flag.txt file on the Grinch’s user’s desktop?
DI3H4rdIsTheBestX-masMovie!
Video Walkthrough