Use Cases
This section provides an overview of common use cases for GoGatoZ (GitLab).
Available Use Cases
Section titled “Available Use Cases”- Scanning for Vulnerabilities - How to effectively scan GitLab projects for CI/CD risks
- Self-Hosted Runner Takeover - Techniques for exploiting GitLab Runner misconfigurations
- Post-Compromise Enumeration - How to enumerate resources after obtaining a GitLab PAT
- Generating Reports - Generate HTML reports and send findings to Discord
- MCP Capstone Lab - Use GoGatoZ as an MCP server with Claude Code for AI-assisted scanning
Choosing the Right Approach
Section titled “Choosing the Right Approach”The approach you take depends on your specific goals:
-
Security Research: Use the search and enumerate commands to identify vulnerabilities in public GitLab projects, then report them responsibly.
-
Red Team Operations: Use GoGatoZ to simulate attacks against your organization’s GitLab CI/CD infrastructure (attack features require explicit authorization).
-
Security Assessment: Use GoGatoZ to assess the CI/CD posture via static analysis of
.gitlab-ci.ymland includes.
Ethical Considerations
Section titled “Ethical Considerations”Always ensure you have proper authorization before using attack features. The search and enumerate features are safe to use on public GitLab projects, but attack features should only be used with explicit permission.