Black Hat SecTOR 2026 Arsenal
SmokedMeat: like Metasploit, but for CI/CD
François is the VP of Security Research at Boost Security and co-creator of the poutine Open Source CI/CD scanner. He co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them.
Arsenal demo of SmokedMeat at Black Hat SecTOR 2026. Track: Exploitation and Ethical Hacking. SmokedMeat is an AGPLv3-licensed, open-source red team and post-exploitation framework for CI/CD pipelines covering the full attack lifecycle: reconnaissance (scanning GitHub Actions workflows for injection vulnerabilities, pwn request exposure, and overly permissive tokens), exploit (auto-crafting payloads deployed via PR, issue, comment, or workflow dispatch), post-exploit (sweeping runner process memory for secrets, enumerating token permissions, collecting loot), and pivot (exchanging OIDC tokens for cloud access, discovering private repos, probing SSH deploy keys, and mapping the full blast radius in a live visual attack graph). Brisket is to CI/CD runners what Meterpreter is to endpoints: a purpose-built, domain-specific post-exploitation implant.
