cdk-escape

Automate container security assessment and escape-path discovery in Docker and Kubernetes.

1.6k|234|Updated Dec 7, 2019

Search Tags:#security #kubernetes #docker #assessment #container #escape #cdk

Ready to run

npx skills add https://github.com/wgpsec/AboutSecurity --skill cdk-escape

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: cdk-escape
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/tool/cdk-escape
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill cdk-escape

SYSTEM DOCUMENTATION & REQUIREMENTS

CDK 帮助安全研究者在进入容器后快速评估逃逸风险、识别潜在逃逸点并进行信息收集。

What problem does it solve?

在进入容器后，CDK 通过自动化评估容器环境、发现逃逸途径和敏感信息点，降低探索成本。

Core Features & Use Cases

环境评估能力：自动检测运行时类型、权限、挂载点等关键信息，快速绘制逃逸路径。
多技术探测：覆盖特权容器、capabilities、Docker socket、K8s 服务账户等逃逸向量的枚举。
Use Case：在渗透测试中，拿到容器 shell 后立即执行 CDK 评估，以明确后续的逃逸或信息收集方向。

Quick Start

在获得容器 shell 后运行 CDK 评估以识别潜在逃逸路径。

Frequently Asked Questions about cdk-escape

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I assess container escape risks after getting a shell in Docker or Kubernetes?▼

To assess container escape risks after getting a shell, you can automate environment evaluation to detect privileged mode, capabilities, mount points, and Docker sockets, mapping potential escape paths for lateral movement.

What common escape vectors should I check for in a Kubernetes container?▼

Common Kubernetes container escape vectors include privileged container configurations, exposed Docker sockets, cgroup mount points, and Kubernetes service account credentials, which can be enumerated automatically to discover exploit paths.

Does this container security assessment require specific dependencies or runtime components?▼

This container security assessment requires no specific dependencies, utilizing a static binary capable of environment evaluation, exploit-path enumeration, and structured output, supporting integration with common container runtimes.

Can I use automated escape path discovery for both Docker and Kubernetes environments?▼

Yes, automated escape path discovery works for both Docker and Kubernetes environments by evaluating container runtimes, permissions, and service account credentials to identify viable escape vectors and inform lateral movement.

What is the best way to enumerate sensitive information inside a compromised container?▼

The best way to enumerate sensitive information inside a compromised container is running an automated assessment to detect runtime types, mount points, and Kubernetes credentials, reducing manual exploration cost and mapping structured escape paths.