An OffSec Adventure Through Modern CI/CD Systems

Jonn Callahan

Burning River Cyber Con

November 15, 2025

SlidesCI/CD · Offensive Security · DevOps

November 15, 2025

Slide deck

View inline above or open in a new tab for your browser's PDF viewer.

View in new tab Download PDF

Speaker

Jonn Callahan

Application security, cloud and containerization researcher — SRA Red Team

Jonn Callahan's background is in application security, cloud environments, and containerization. His interest in writing code and architecting systems has led to a refined talent for deep diving highly complex and disparate systems. His work in SRA's R&I team building internal tool suites and contributions to Red Team strategy has resulted in leading high-profile engagements across startups and large enterprises.

Talk overview

For many organizations, long gone are the days of poorly managed Jenkins servers. For OffSec practitioners, so are the easy script-console pivot points. The modern development landscape is a complicated system of third-party SaaS platforms, custom integrations, complex control planes, and bespoke development processes. This talk explores these modern systems, the controls they expose, and inherent weaknesses. It addresses the problem from a high-level design perspective and maps exploitation primitives and controls to popular source-forge providers. Rather than rehashing OIDC or pwn request talks, it focuses on how even well-designed systems provide opportunities for full production takeovers from a single compromised developer account.

Share

Share this talk with your crew or on social.

Share on X Share on Bluesky