Detect Kubernetes and Docker security misconfigurations and privilege escalation paths.
npx skills add https://github.com/uphiago/recon-skills --skill hunt-k8s-uphiago
Please help me install this Agent Skill. Skill: hunt-k8s Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-k8s Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-k8s-uphiago
This Skill eliminates the manual, error-prone work of identifying high-impact Kubernetes and Docker security misconfigurations, unpatched CVEs, and privilege escalation paths that lead to full cluster or host compromise during authorized penetration testing of containerized infrastructure.
Use the hunt-k8s skill to scan a target for exposed Kubernetes and Docker services, validate critical misconfigurations, and confirm RCE or credential leak vulnerabilities for your authorized penetration test.
High-intent search queries and answers about installing and using this skill.
To find Kubernetes privilege escalation paths, you can scan for anonymous API admin access, exploitable kubelet RCE ports, and unauthenticated etcd access to identify routes for full cluster compromise.
The difference is that read-only kubelet port 10255 provides non-exploitable data, while port 10250 exposes /run command execution vectors that allow remote code execution when misconfigured.
You validate docker.sock exposure by confirming socket access and interacting with the Docker API to spawn a privileged container, proving you can mount the host filesystem and achieve host escape.
Yes, it detects runc container escape vulnerabilities by hunting for unpatched CVEs and specific misconfigurations in containerized environments that allow breaking out of the container sandbox to access the host.
The best way to prevent false positives when scanning for kubelet RCE is to use out-of-band confirmation gates and validation checklists that verify actual command execution rather than assuming port exposure alone equals vulnerability.
You can dump unencrypted etcd secrets without prior cluster authentication if the etcd service exposes unauthenticated access, allowing direct database reads to extract sensitive credentials and cluster configuration data.
sseshachalaIdentify Kubernetes and Docker security misconfigurations enabling unauthorized access and data leakage.
DorianGalloEnumerate Kubernetes RBAC, service account tokens, and exposed endpoints during authorized penetration tests.
xalgordAudit Kubernetes deployments for misconfigurations and insecure access vectors.
wyre-technologyList, search, and retrieve SentinelOne XSPM cloud security misconfigurations.
