skills.rest
inventashif
inventashifCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-k8s

Tests Kubernetes and Docker infrastructure for misconfigurations, unauthenticated access, and container escape vulnerabilities.

Updated Sep 6, 2026
Search Tags:#penetration testing#kubernetes#docker#bug bounty#etcd#container escape#kubelet
One-click install
npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-k8s-inventashif
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-k8s
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/hunt-k8s
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-k8s-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security researchers and bug bounty hunters need a structured methodology to assess Kubernetes and Docker targets, where misconfigurations like anonymous API access, exposed kubelets, and unauthenticated etcd can lead to full cluster compromise but are easy to misidentify or over-report. ## Core Features & Use Cases - Phased attack-surface enumeration: Fingerprint K8s ports (6443/10250/10255/2379/8443), check API anonymous access with SelfSubjectRulesReview, and probe kubelet /run and /exec primitives correctly (SPDY/WebSocket streams, not plain POST). - High-impact exploit paths: Covers etcd 2379 unauthenticated Secret dumps, docker.sock host escape, runc container escapes (CVE-2024-21626), API-server-mediated nodes/proxy RCE, SA token audience/expiry abuse, and Ingress-NGINX CVE-2025-1974. - False-positive prevention: Distinguishes 10255 read-only info disclosure from 10250 RCE, explains why anonymous 200 responses are not cluster-admin, and requires decoded Secret bytes or command output as impact proof. - Use Case: During a bug bounty engagement you discover port 10250 open on a target. Use this Skill to enumerate pods, execute a read-only id command via /run, steal the pod SA token, and validate its real RBAC grants before writing the report. ## Quick Start Use the hunt-k8s skill to assess whether the target's exposed Kubernetes API on port 6443 allows anonymous access with meaningful privileges.

Frequently Asked Questions about hunt-k8s

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test a Kubernetes API for anonymous access?▼

Query the API server's /version and /api endpoints anonymously, then submit a SelfSubjectRulesReview to determine actual granted verbs. A 200 response alone is not proof of privilege since RBAC-filtered lists return empty items; confirm by reading a real Secret value.

How do I get RCE through the kubelet on port 10250?▼

Use the /run endpoint with a POST containing cmd=id, which returns command output directly. The /exec endpoint is a SPDY/WebSocket stream that returns a 302 redirect, so use kubeletctl or websocat to follow the stream rather than a plain curl POST.

What is the difference between kubelet port 10250 and 10255?▼

Port 10250 is the authenticated HTTPS kubelet with /run and /exec primitives enabling RCE. Port 10255 is the read-only HTTP kubelet exposing only /pods, /stats, and /metrics, which is information disclosure and must not be reported as RCE.

Can a stolen Kubernetes service account token always access the API server?▼

No. Modern projected tokens are bound with an audience and short expiry, so decode the JWT and check the aud and exp claims first. A token issued for a Vault or OIDC audience will not authenticate to the API server, and expired tokens are dead.

Why does my Kubernetes CVE exploit not work on a target?▼

Most K8s CVEs are version-gated, so fingerprint gitVersion from /version and the runc version before asserting exploitability. CVE-2018-1002105, CVE-2024-21626, and CVE-2019-5736 each require specific vulnerable versions, and a version match is only a lead until PoC output confirms it.

How do I prove impact for an etcd unauthenticated access finding?▼

Use etcdctl to perform a range read on /registry/secrets and show decoded Secret bytes, redacted in the report. A key listing or a 200 from the peer port 2380 is insufficient, and if EncryptionConfiguration is enabled the values will be ciphertext rather than plaintext secrets.

Related Skills

Explore More Software Engineering Skills→
darblexdarblex

Nmap Recon

Scan targets with Nmap to find open ports and detect services.

Community
Intermediate
marcboggsmarcboggs

report-writing

Writes impact-first bug bounty reports for HackerOne, Bugcrowd, Intigriti, and Immunefi with CVSS scoring.

Community
Intermediate
uphiagouphiago
1.1k

hunt-ssrf

Detect and validate SSRF vulnerabilities with out-of-band confirmation.

Community
Advanced
Yenn503Yenn503
1

performing-kubernetes-penetration-testing

Tests Kubernetes cluster security by probing API server, kubelet, etcd, RBAC, and secrets.

Community
Intermediate