gato-x - GitHub Attack Toolkit - Extreme Edition - A static

项目说明

!Supported Python
![Code style: black]()

Gato (Github Attack TOolkit) - Extreme Edition

Gato-X is a _FAST_ scanning and attack tool for GitHub Actions pipelines. You can use it to identify
Pwn Requests, Actions Injection, TOCTOU , and Self-Hosted Runner takeover at scale using just a single API token. It will also analyze cross-repository workflows and reusable actions. This surfaces that other scanners miss because they only scan workflows within a single repository.

Gato-X is an operator focused tool that is tuned to avoid false negatives. It will have a higher false positive rate than SAST tools like CodeQL, but Gato-X will give you e you need to quickly determine if something is a true positive or not!

The search and enumerate modes are safe to run on all public repositories, and
you will not any rules by doing so.

Gato-X's attack features should only be used with authorization, and make sure
to follow responsible disclosure if you find with Gato-X.

Gato-X is a powerful tool and should only be used for ethical security research purposes.

Documentation

For comprehensi, please visit the Gato-X Documentation site.

What is Gato-X?

Gato-X is an offensi tool designed to identify exploitable GitHub Actions misconfigurations or pri escalation paths. It focuses on several key areas:

* Self-Hosted Runner enumeration using static analysis of workflow files and analysis of workflow run logs
* Pwn Request and Actions Injection enumeration using static analysis
* Post-compromise secrets enumeration and exfiltration
* Public repository self-hosted runner attacks using Runner-on-Runner (RoR) technique
* Private repository self-hosted runner attacks using RoR technique

The target audience for Gato-X is Red Teamers, Bug Bounty Hunters, and Security Engineers looking to identify misconfigurations.

Feature Highlights

Fast and Comprehensi

Gato-X contains a powerful scanning engine for GitHub Actions . It is capable of scanning 35-40 *thousand* repositories in 1-2 hours using a single GitHub PAT. Key capabilities include:

* Reachability Analysis
* Cross-Repository Transiti and Reusable Action Analysis
* Parsing and Simulation of "If Statements"
* Gate Check Detection (permission checks, etc.)
* Lightweight Source-Sink Analysis for
* MCP Server

Quick Start

Search For GitHub Actions at GitHub Scale

First, create a GitHub PAT with the repo scope. Set that PAT to the
GH_TOKEN en .

Next, use the search feature to retrieve a list of candidate repositories:

Finally, run Gato-X on the list of repositories:

This will take some time depending on your computer and internet connection speed. Since the results are very long, use tee to save them to a file
for later review. Gato-X also supports JSON output, but that is intended for further machine analysis.

Perform Self Hosted Runner Takeover

To perform a public repository self-hosted runner takeo, Gato-X requires a PAT with the following scopes:

repo, workflow, and gist.

This should be a PAT for an account that is a _contributor_ to the target repository (i.e. submitted a typo fix).

It is very rare that maintainers select allowing workflows on pull request from all external users without approval,
but it has happened.

Next, Gato-X will automatically prepare a C2 repository and begin the operation. Gato-X will monitor each step
as the attack continues, exiting as gracefully as possible at each phase in case of a failure. If workflow approval
is required, Gato-X will wait a short period of time before exiting.

If the full chain succeeds, Gato-X will drop to an interacti. This will execute shell commands on the
self-hosted runner.

If the target runner is non-ephemeral, use the --keep-alive flag. This will keep the workflow running. GitHub
Actions allows workflow runs on self-hosted runners to run for up to 5 days (as of writing, this might change - it was 30 days).

Dump Secrets

If you have a PAT with write access to the repository along with the repo and workflow scopes, you can dump all secrets accessible to the repository with a single command:

gato-x attack --secrets -t targetOrg/targetRepo -d

See documentation for additional options such as specifying workflow name, branch name, and more.

Installation

Gato supports OS X and Linux with at least Python 3.10.

Gato-X is published on PyPi, so you can simply install it with pip install gato-x

In order to install the tool from source, simply clone the repository and use pip install.

We recommend performing this within a en.

OR You can use pipx

If you need to make on-the-fly modifications, then install it in editable mode with pip install -e.

Contributing

Contributions are welcome! Please review the design methodology before working on a new feature!

Additionally, if you are proposing significant changes to the tool, please open an issue to start a con about the moti for the changes.

License

Gato-X is licensed under the Apache License, 2.0.

项目信息

开发语言：Python

Star 数：592

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕GitHub Attack Toolkit - Extreme Edition - A static analysis and exploit toolkit for GitHub Actions.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。