Skip to content

CHANGELOG.md

Latest commit

 

History

History
151 lines (125 loc) · 8.08 KB

CHANGELOG.md

File metadata and controls

151 lines (125 loc) · 8.08 KB
Raw

Changelog

All notable changes to htpx are documented here.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

htpx is the source of truth for the red↔blue paired corpus; it is vendored into dotfiles-Kali at offensive/companion/ via git subtree. Cutting a release here (a new top version below) tags the repo and fans the change OUT to dotfiles-Kali as a companion.lock-bump PR — see .github/workflows/auto-tag.yml and .github/workflows/sync-fanout.yml.

How releasing works

Add user-visible changes under [Unreleased]. To cut a release, move the [Unreleased] entries under a new ## [vX.Y.Z] - YYYY-MM-DD heading and push to main: auto-tag.yml sees the new top version, tags vX.Y.Z, and publishes a GitHub Release; sync-fanout.yml then opens the Kali sync PR.

[Unreleased]

Added

  • Jenkins CI/CD platform (3 companion-only red↔blue pairs) — the self-hosted counterpart to the GitHub/GitLab SaaS rounds, detected via the Jenkins Audit Trail plugin log (product: jenkins, keyword/URI matches):

    • jenkins-script-console ↔ jenkins-script-console-audit — Groovy Script Console RCE + in-memory credential dump; detect /script / /scriptText (T1059).
    • jenkins-api-token ↔ jenkins-api-token-audit — mint a user API token for durable non-interactive access; detect generateNewToken (T1098).
    • jenkins-job-backdoor ↔ jenkins-job-backdoor-audit — create/reconfigure a job to run attacker code on the controller + agents; detect /createItem / /job/<name>/configSubmit (T1072).

  • Terraform Cloud / IaC platform (3 companion-only red↔blue pairs) — detections are Terraform Cloud audit-trail SPL (product: terraform, nested resource.type / resource.action):

    • tfc-agent-hijack ↔ tfc-agent-audit — rogue agent pool routes plans/applies to attacker infra (captures cloud creds + state); detect agent_pool create (T1543).
    • tfc-token-backdoor ↔ tfc-token-audit — mint an org/team API token for durable API + state access; detect authentication_token create (T1098).
    • tfc-var-injection ↔ tfc-var-audit — inject a workspace env variable to run code / exfil at apply; detect variable create/update (T1072).

  • HashiCorp Vault platform (3 companion-only red↔blue pairs), opening the secrets-management seam — detections are Vault audit-device SPL (product: vault on the Sigma side):

    • vault-secret-exfil ↔ vault-secret-read-audit — bulk-read KV secrets to drain the credential store; detect read breadth over secret/ paths (T1555).
    • vault-approle-backdoor ↔ vault-approle-audit — create a rogue AppRole for durable machine auth; detect create/update on auth/approle/role/ (T1098).
    • vault-audit-disable ↔ vault-audit-device-audit — disable a Vault audit device to blind the SIEM; detect delete on a sys/audit/ path (T1562.001).

  • GitLab CI/CD platform (3 companion-only red↔blue pairs), mirroring the GitHub Actions round on GitLab audit-event telemetry (product: gitlab, field event_type):

    • gl-runner-hijack ↔ gl-runner-audit — attach an attacker-controlled runner to the project to capture CI jobs + masked variables; detect set_runner_associated_projects (T1543).
    • gl-protected-branch-off ↔ gl-protected-branch-audit — remove protected-branch rules to land unreviewed code; detect protected_branch_removed / protected_branch_created (T1562.001).
    • gl-token-backdoor ↔ gl-token-audit — mint a project access / deploy token for durable access; detect project_access_token_created / personal_access_token_created / deploy_token_created (T1098).

  • Harbor container registry platform (3 companion-only red↔blue pairs), opening the container-image / registry supply-chain seam — detections are Harbor registry audit-log SPL (product: harbor on the Sigma side):

    • harbor-image-backdoor ↔ harbor-image-push-audit — push a trojanized image over a trusted tag to poison downstream pulls; detect operation=push artifact (T1525, Implant Internal Image).
    • harbor-robot-backdoor ↔ harbor-robot-audit — mint a long-lived robot account for durable registry access; detect operation=create resource_type=robot (T1098).
    • harbor-artifact-delete ↔ harbor-artifact-delete-audit — delete the trusted artifact to force a poisoned re-pull + erase evidence; detect operation=delete artifact/repository (T1070).

  • GitHub Actions CI/CD platform (3 companion-only red↔blue pairs), opening a new logsource the way the Okta round did — detections are GitHub Enterprise audit-log SPL (product: github on the Sigma side):

    • gh-self-hosted-runner ↔ gh-runner-audit — rogue self-hosted runner harvests job source + secrets; detect self_hosted_runner.created (T1543).
    • gh-branch-protection-off ↔ gh-branch-protection-audit — disable/override branch protection to land unreviewed code; detect protected_branch.destroy / protected_branch.policy_override (T1562.001).
    • gh-deploy-key-backdoor ↔ gh-cred-audit — writable deploy key / fine-grained PAT for durable access; detect repo.create_deploy_key / personal_access_token.access_granted (T1098).

  • Corpus is now 53 paired concepts + 1 unpaired recon entry.

[v1.4.0] - 2026-06-30

Fixed

  • sync-fanout.yml Sync step: call Kali's sync-companion.sh with NO argument. It was passed main as a positional, but that arg is the REMOTE (URL), not a branch so it tried to pull from a remote named main (fatal: 'main' does not appear to be a git repository). The script derives both the htpx remote and the branch (main) from companion.lock itself.
  • sync-fanout.yml auth: the Sync step now injects all git auth + the bot identity via step-scoped GIT_CONFIG_COUNT/KEY/VALUE instead of git config --global (no token written to ~/.gitconfig; consistent with the Resolve step). htpx is read with the built-in GITHUB_TOKEN via a more-specific, .git-anchored url.insteadOf (longest match wins, and the anchor avoids rewriting same-prefix repos like <owner>/htpx-tools), so the git subtree pull works without FLEET_SYNC_TOKEN ever needing htpx access; FLEET_SYNC_TOKEN stays scoped to the dotfiles-Kali clone/push/PR.

[v1.3.0] - 2026-06-30

Fixed

  • sync-fanout.yml Resolve step: the htpx clone / ls-remote reads are now authenticated with the built-in GITHUB_TOKEN (contents: read). They were unauthenticated, so on a private htpx the fan-out died at the first clone with could not read Username for 'https://github.com'. Auth is injected via GIT_CONFIG_COUNT/KEY/VALUE env (an url.insteadOf rewrite scoped to that step), so the token is never written to ~/.gitconfig and can't shadow the next step's actions/checkout; FLEET_SYNC_TOKEN stays reserved for the cross-repo writes to dotfiles-Kali.
  • Release + fan-out workflows hardened (PR review): auto-tag.sh now fails loud when --release is requested but gh is absent; auto-tag.yml cuts tags/releases only from the default branch; sync-fanout.yml resolves and verifies the tag exists before checkout (a bad dispatch input is a clean no-op), aborts the sync if gen-views.sh fails (no PR), and fails on ANY core.lock diff versus the base branch — not just the core_sha field.

[v1.2.0] - 2026-06-30

Added

  • Release automation: auto-tag.yml tags + releases on a new top CHANGELOG version, and sync-fanout.yml fans the released ref out to dotfiles-Kali as a companion.lock-bump PR this CHANGELOG seeds that pipeline at the current tag.

[v1.1.0]

Added

  • Polished README landing-page hero.

[v1.0.0]

Added

  • Initial standalone extraction of the structured red↔blue paired companion from dotfiles-Kali: htpx fzf browser, gen-views.sh source-of-truth bridge with --check drift gate, and the ATT&CK-tagged entries/red|blue/*.md corpus.