hunt-k8s

Check Kubernetes API port 6443 for anonymous access by performing version checks, RBAC reviews, and token decoding to identify unauthorized access paths. Validate impact using safe proof artifacts while avoiding destructive actions during the security assessment.

Kubernetes misconfigurations exposing service account tokens include insecure RBAC permissions, bound or projected SA-token audience abuse, and exposed etcd on port 2379. Review RBAC configurations and decode tokens to detect credential exposure paths.

Test kubelet port 10250 for remote code execution by using the SPDY or WebSocket exec primitives and the /run endpoint, rather than plain POST requests. Validate RCE paths safely with proof artifacts to avoid destructive actions during testing.

This Kubernetes security scan covers Docker container escapes including the Leaky Vessels CVE-2024-21626 runc vulnerability. It identifies docker.sock host escape paths and container escape techniques across exposed containerized infrastructure.

Find Helm Tiller remnants and dashboard skip-login vulnerabilities by scanning exposed Kubernetes ports 6443, 10250, 10255, 2379, and 8443. Document misconfigurations enabling unauthorized access to ensure comprehensive cluster security coverage.

Detect admission controller bypass and EphemeralContainers node-shell risks by reviewing API-server-mediated nodes/proxy RCE paths. Apply security checks across clusters exposing Kubernetes ports and cloud metadata surfaces revealing service accounts.