Automating the boring part: Penetration Testing VMs deployment as Code

No ratings

Presented at GrrCON 2025 by

Jacob Harrand

In the world of cloud infrastructure, agility and repeatability are key. This talk will walk through a practical approach to automating the creation of identical VMs using infrastructure-as-code principles, with a lens of offensive security. By combining Terraform, Ansible, and self-hosted GitHub Actions runners, I will show how to spin up cloud-based virtual machines that are on-demand, consistent, and ephemeral. We will start with how Terraform can provision infrastructure across popular cloud providers, using Azure as the example, followed by how Ansible configures those systems with your favorite tools and workflow preferences. Then, we will dive into using self-hosted GitHub runners to keep your data within your control all while maintaining a seamless CI/CD pipeline. You will see how this setup enables secure, scalable, and reproducible environments that reduce setup time and operational overhead, while also improving isolation and auditability. Whether you are a solo consultant or part of a red team at scale, this talk will give you actionable steps and code samples to start building your own on-demand pentest VMs. Expect some war stories, lessons learned, and a clear path to automating the boring stuff so you can focus on popping shells.