Kubernetes Pentesting
Kubernetes Pentesting
https://cloud.hacktricks.xyz/pentesting-cloud/kubernetes-security
Kubernetes Pentesting:
Pentesting Kubernetes Services
Exposing Services in Kubernetes
Attacking Kubernetes from inside a Pod
Kubernetes Role-Based Access Control(RBAC)
Abusing Roles/ClusterRoles in Kubernetes
Kubernetes Namespace Escalation
Kubernetes Pentesting
Support HackTricks and get benefits!
Kubernetes Basics
If you don't know anything about Kubernetes this is a good start. Read it to learn about the architecture, components and basic actions in Kubernetes:
Labs to practice and learn
Hardening Kubernetes / Automatic Tools
Manual Kubernetes Pentest
From the Outside
There are several possible Kubernetes services that you could find exposed on the Internet (or inside internal networks). If you find them you know there is Kubernetes environment in there.
Depending on the configuration and your privileges you might be able to abuse that environment, for more information:
Pentesting Kubernetes Services
Enumeration inside a Pod
If you manage to compromise a Pod read the following page to learn how to enumerate and try to escalate privileges/escape:
Attacking Kubernetes from inside a Pod
Enumerating Kubernetes with Credentials
You might have managed to compromise user credentials, a user token or some service account token. You can use it to talk to the Kubernetes API service and try to enumerate it to learn more about it:
Another important details about enumeration and Kubernetes permissions abuse is the Kubernetes Role-Based Access Control (RBAC). If you want to abuse permissions, you first should read about it here:
Kubernetes Role-Based Access Control(RBAC)
Knowing about RBAC and having enumerated the environment you can now try to abuse the permissions with:
Abusing Roles/ClusterRoles in Kubernetes
Privesc to a different Namespace
If you have compromised a namespace you can potentially escape to other namespaces with more interesting permissions/resources:
Kubernetes Namespace Escalation
From Kubernetes to the Cloud
If you have compromised a K8s account or a pod, you might be able able to move to other clouds. This is because in clouds like AWS or GCP is possible to give a K8s SA permissions over the cloud.
Last updated