GHARF：GitHub Actions RedTeam Framework
summary
A GitHub-based framework automates red‑team cycles by treating workflows as C2: GitHub Actions as C2 uses self-hosted runners on target hosts, runs shell and JavaScript commands, and stages payloads by file upload/download via repo. It ships CLI and interactive clients, a web UI trigger, approval/consent checks, IOC embedding, and example flows (SharpHound collection, Rubeus NTLM dump + Hashcat cracking). Setup is three steps, code is OSS on GitHub, and basic AV detection (Windows Defender) is verified.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:29Red teaming and CI/CD basics
- 3:16Red team challenges and CAICAD
- 4:18GHARF framework background and features
- 5:43GitHub Actions and self-hosted runners
- 7:49GHARF tech and C2 server role
- 8:11GHARF features and architecture
- 13:30Using GHARF workflows
- 16:00GHARF implementation and commands
- 21:01GHARF demo and runner setup
- 23:58GHARF CLI and interactive client
- 31:24GHARF WebUI manual execution
- 33:46GHARF ethics and security
- 35:57Summary and future outlook
- 36:49Q&A
related talks
55mBeyond the Commit: Weaponizing and Hardening GitHub Actions
01h 00mIntroduction to GitHub Actions
55mGitHub Actions: Vulnerabilities, Attacks, And Counter-Measures
15mGitHub Actions: a time bomb for supply chain security
57mGitHub Actions: Vulnerabilities, Attacks, and Counter-measures
56mHow to use GitHub Actions with Security in mind
21mExplore advanced developer tools and automations for enhanced security
44mAttacking & Defending Supply Chains. How we got Admin in your Cloud,...