Weaponising the cloud : Turning devops pipeline into DDoS booters

This talk explores how publicly available CI/CD pipeline services can be misused to launch high-impact Distributed Denial-of-Service (DDoS) attacks. By leveraging the free compute resources offered by popular DevOps platforms, attackers can deploy lightweight booter scripts capable of sending tens of thousands of HTTP requests per second, effectively making websites inaccessible. The session highlights the attack methodology and its implications for service providers and victims and outlines strategies for detection and prevention.

CI/CD platforms like GitHub Actions, GitLab CI, and Jenkins are designed to automate software development workflows. However, attackers can abuse these systems by creating malicious workflows that generate massive HTTP/S request floods. Since CI/CD runners often have high bandwidth and distributed infrastructure, they can be weaponised into effective DDoS "booter" tools, capable of sending tens of thousands of requests per second—far exceeding traditional botnet capabilities.