{"id":13633405,"url":"https://github.com/praetorian-inc/gato","last_synced_at":"2025-05-15T10:07:25.148Z","repository":{"id":65555946,"uuid":"585973808","full_name":"praetorian-inc/gato","owner":"praetorian-inc","description":"GitHub Actions Pipeline Enumeration and Attack Tool","archived":false,"fork":false,"pushed_at":"2025-04-10T23:25:04.000Z","size":5576,"stargazers_count":629,"open_issues_count":13,"forks_count":55,"subscribers_count":8,"default_branch":"main","last_synced_at":"2025-04-21T18:52:21.695Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/praetorian-inc.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2023-01-06T15:43:27.000Z","updated_at":"2025-04-21T18:48:17.000Z","dependencies_parsed_at":"2023-10-15T22:45:47.191Z","dependency_job_id":"1941b986-488b-415b-85d6-0006657aa452","html_url":"https://github.com/praetorian-inc/gato","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/praetorian-inc%2Fgato","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/praetorian-inc%2Fgato/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/praetorian-inc%2Fgato/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/praetorian-inc%2Fgato/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/praetorian-inc","download_url":"https://codeload.github.com/praetorian-inc/gato/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254319720,"owners_count":22051073,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T23:00:37.486Z","updated_at":"2025-05-15T10:07:20.132Z","avatar_url":"https://github.com/praetorian-inc.png","language":"Python","funding_links":[],"categories":["Miscellaneous","Python","工具与代码库","Tools"],"sub_categories":["Git","平台与工具安全专题","Defense Evasion","ArgoCD"],"readme":"![Supported Python versions](https://img.shields.io/badge/python-3.7+-blue.svg)\n\n# Gato (Github Attack TOolkit)\n\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"https://user-images.githubusercontent.com/2006441/212176664-2ffb61ec-1b40-49cb-8cb2-7a9127a51f3b.PNG\" alt=\"gato\"/\u003e\n\u003c/p\u003e\n\n\nGato, or GitHub Attack Toolkit, is an enumeration and attack tool that allows\nboth blue teamers and offensive security practitioners to identify and exploit\npipeline vulnerabilities within a GitHub organization's public and private\nrepositories.\n\nThe tool has post-exploitation features to leverage a compromised personal\naccess token in addition to enumeration features to identify poisoned pipeline\nexecution vulnerabilities and actions artifacts secrets against public\nrepositories.\n\nGitHub recommends that self-hosted runners only be utilized for private\nrepositories, however, there are thousands of organizations that utilize\nself-hosted runners. Default configurations are often vulnerable, and Gato uses\na mix of workflow file analysis and run-log analysis to identify potentially\nvulnerable repositories at scale.\n\n## Version 1.7\n\nGato version 1.7 introduces the **Actions Artifacts Secrets Scanner**.\n\nThe Actions Artifacts Secrets Scanner enumerates [GitHub Actions workflow\nartifacts](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/storing-and-sharing-data-from-a-workflow)\nfor secrets. Praetorian researchers have leveraged the scanner to identify\ncritical vulnerabilities in several prominent open-sourced projects. Details of\nthese vulnerabilities will be released once the disclosure processes are\ncomplete. This work was initially inspired by research from [Palo Alto\nNetworks](https://unit42.paloaltonetworks.com/github-repo-artifacts-leak-tokens/).\n\nThe Actions Artifacts Secrets Scanner performs the following actions:\n1. Downloads GitHub Actions workflow artifacts from the target repository\n2. Recursively extracts the downloaded artifacts\n3. Scans the artifacts for secrets with\n   [NoseyParker](https://github.com/praetorian-inc/noseyparker)\n4. Reports the results\n\n[NoseyParker](https://github.com/praetorian-inc/noseyparker/releases) must be\ninstalled in the $PATH of the system running the Actions Artifacts Secrets\nScanner.\n\nSecrets in public workflow artifacts can contain many false positives. By\ndefault, the Actions Artifacts Secrets Scanner excludes rules and results\nassociated with common false positives. To include all secrets scanning results,\nyou can use the `--include_all_artifact_secrets` flag.\n\nHere is an example command that runs the Actions Artifacts Secrets Scanner on a\nlist of GitHub organizations, disables self-hosted runner enumeration, includes\nall artifact secret results, and outputs to a JSON file.\n\n```\ngato e --enum_wf_artifacts --include_all_artifact_secrets --skip_sh_runner_enum -O testorgs.txt  -oJ testorgoutput.json\n```\n\nBy default, the Actions Artifacts Secrets Scanner imposes the following\nlimitations to reduce the time spent on a single repository:\n- Only downloads one artifact per name\n- Downloads a maximum of 50 artifacts per repository\n- Downloads a maximum of 10 files greater than 536 MBs\n- Does not download any files greater than 2.68 GBs\n\nThese constraints were optimized such that the Actions Artifacts Secrets Scanner\ncan scan the top 200 GitHub organizations within 48 hours. If you want to modify\nthese constraints, you can update them in the `scan_wf_artifacts()` function of\n`gato/enumerate/repository.py`.\n\n## New Features\n\n- Added the Actions Artifacts Secrets Scanner\n- Support to run modules on a list of GitHub organizations\n- Ability to disable self-hosted runner enumeration\n- Option to disable sleep\n- Differentates between public and private repos in output\n- Several bug fixes\n- Enumerate support for GitHub App Installation tokens\n\n## Who is it for?\n\n- Security engineers who want to understand the level of access a compromised\n  classic PAT could provide an attacker\n- Blue teams that want to build detections for self-hosted runner attacks\n- Red Teamers\n- Bug bounty hunters who want to try and prove RCE on organizations that are\n  utilizing self-hosted runners\n\n## Features\n\n* GitHub Classic PAT Privilege Enumeration\n* GitHub Code Search API-based enumeration\n* SourceGraph Search enumeration\n* GitHub Action Run Log Parsing to identify Self-Hosted Runners\n* Bulk Repo Sparse Clone Features\n* GitHub Action Workflow Parsing\n* Automated Command Execution Fork PR Creation\n* Automated Command Execution Workflow Creation\n* Automated workflow secrets exfiltration\n* SOCKS5 Proxy Support\n* HTTPS Proxy Support\n* GitHub Actions Workflow Artifacts Secrets Scanning\n\n## Getting Started\n\n### Installation\n\nGato supports OS X and Linux with at least **Python 3.7**.\n\nIn order to install the tool, simply clone the repository and use `pip install`. We\nrecommend performing this within a virtual environment.\n\n```\ngit clone https://github.com/praetorian-inc/gato\ncd gato\npython3 -m venv venv\nsource venv/bin/activate\npip install .\n```\n\nGato also requires that `git` version `2.27` or above is installed and on the\nsystem's PATH. In order to run the fork PR attack module, `sed` must also be\ninstalled and present on the system's path.\n\n#### Dev Branch\n\nWe maintain a development branch that contains newer Gato features that are not\nyet added to main. There is an increased chance you will run into bugs; however,\nwe still run our integration test suite on the `dev` branch, so there should not\nbe any _blatant_ bugs.\n\nIf you want to use the `dev` branch, just check it out prior to running pip\ninstall - that's it!\n\nIf you do run into any bugs for your specific use case, by all means open an\nissue!\n\n### Usage\n\nAfter installing the tool, it can be launched by running `gato` or\n`praetorian-gato`.\n\nWe recommend viewing the parameters for the base tool using `gato -h`, and the\nparameters for each of the tool's modules by running the following:\n\n* `gato search -h`\n* `gato enum -h`\n* `gato attack -h`\n\nThe tool requires a GitHub classic or app installation token in order to\nfunction. To create one, log in to GitHub and go to [GitHub Developer\nSettings](https://github.com/settings/tokens) and select `Generate New Token`\nand then `Generate new token (classic)`.\n\nAfter creating this token set the `GH_TOKEN` environment variable within your\nshell by running `export GH_TOKEN=\u003cYOUR_CREATED_TOKEN\u003e`. Alternatively, store\nthe token within a secure password manager and enter it when the application\nprompts you.\n\nIf creating a GitHub App Installation token, the app needs to have at least\n`Actions:read` and `Contents:read` to execute the enumeration modules.\n\nFor troubleshooting and additional details, such as installing in developer\nmode or running unit tests, please see the [wiki](https://github.com/praetorian-inc/gato/wiki).\n\n## Documentation\n\nPlease see the [wiki](https://github.com/praetorian-inc/gato/wiki) for detailed\ndocumentation, as well as\n[OpSec](https://github.com/praetorian-inc/gato/wiki/opsec) considerations for\nthe tool's various modules!\n\n## Bugs\n\nIf you believe you have identified a bug within the software, please open an\nissue containing the tool's output, along with the actions you were trying to\nconduct.\n\nIf you are unsure if the behavior is a bug, use the discussions section instead!\n\n\n## Contributing\n\nContributions are welcome! Please\n[review](https://github.com/praetorian-inc/gato/wiki/Project-Design) our design\nmethodology and coding standards before working on a new feature!\n\nAdditionally, if you are proposing significant changes to the tool, please [open\nan issue](https://github.com/praetorian-inc/gato/issues/new) to start a\nconversation about the motivation for the changes.\n\n## License\n\nGato is licensed under the [Apache License, Version 2.0](LICENSE).\n\n```\nCopyright 2023 Praetorian Security, Inc\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpraetorian-inc%2Fgato","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpraetorian-inc%2Fgato","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpraetorian-inc%2Fgato/lists"}