DIY Pen-Testing for Your Kubernetes Cluster
summary
kube-hunter is an open source scanner that simulates attacker behavior against Kubernetes clusters, issuing REST calls to default ports (e.g. 8080, 6443, Kubelet 10250) to reveal misconfigurations like an unsecured Kubelet API or an anonymous user listing pods. it runs locally or inside a pod to re-use service account tokens, supports passive vs active hunters (active mode can create a privileged pod then remove it), is written in Python using an observer pattern, and is CI-compatible.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 0:54What is penetration testing
- 2:33Why should you do penetration testing
- 5:00REST API requests
- 7:11Kubernetes defaults
- 7:57Insecure port
- 10:22Secure port
- 11:38Anonymous requests
- 13:42Service account tokens
- 16:46Secret tokens
- 18:11Other Kubernetes APIs
- 19:07Kuebler
- 20:41KeepHunter
- 21:49KeepHunter Pod Mode
- 22:15KeepHunter Inside a Pod
- 22:33Active Hunters
- 23:52Observer Pattern
- 25:46Questions
related talks
38mKubernetes Security: Attacking and Defending K8s Clusters
42mAttacking and Defending Kubernetes Cluster: Kubesploit vs KubiScan
29mKubernetes Security: Attacking and Defending K8s Clusters
49mAttacking and Detecting Attacks on Kubernetes Clusters
45mThe Hacker’s Guide to Kubernetes
35mInsights into Unsecured Kubernetes in the Wild
38mKubernetes Security: Attacking and Defending K8s Clusters
01h 24mTutorial: Attacking and Defending Kube...