How GitLab's Red Team automates C2 testing
Nov 28, 2023Josh Feehs

Summary
This post details the automation of C2 testing for GitLab's Red Team using the Mythic framework and GitLab CI/CD. It introduces a public project containing pytest integration tests for Mythic server and agents, utilizes git submodules for agent source code management, and outlines the configuration of GitLab CI/CD pipelines for automated testing on merge requests and tagged commits. Prerequisites and project structure are explained, along with implementation details for pytest files, the GlMythic class, and agent interaction. The CI/CD configuration includes setting up runners, environment variables (MYTHIC_ADMIN_PASSWORD, AGENT_TYPE), and defining pipeline stages for installation and testing.
More from the Security Control Framework trail
- Track organization-wide security risk in one dashboard
- Dependency Firewall: Block risky packages before the build
- Two front doors: Module-level access in a Django GRC app
- How GitLab tracks vulnerabilities through refactors and reformatting
- Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting