skills.rest
wgpsec
wgpsecOFFICIAL
Explore all skills by this author →
Website𝕏@wgpsecGitHub

k8spider

Enumerate Kubernetes Services and DNS records via cluster DNS queries without API credentials.

1.6k|234|Updated Dec 7, 2019
Search Tags:#kubernetes#dns#service-discovery#k8spider#ptr-scan#srv-enum#axfr
One-click install
npx skills add https://github.com/wgpsec/AboutSecurity --skill k8spider
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: k8spider
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/tool/k8spider
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill k8spider

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provides a practical method to discover Kubernetes Services and cluster resources when API credentials are unavailable by using DNS queries and network-based enumeration techniques. It removes the need for API Server tokens and allows low-privilege enumeration from within a pod or any host with DNS access to the cluster.

Core Features & Use Cases

  • DNS-based Service Discovery: Enumerate services and namespaces by performing PTR, SRV, and wildcard DNS queries against the cluster DNS.
  • Multiple Enumeration Modes: Supports full "all" scans, CIDR-based PTR sweeps, SRV probing, wildcard resolution, AXFR zone transfer attempts, neighbor/subnet scanning, and kube-state-metrics parsing for additional metadata.
  • Operational Scenarios: Use inside a compromised pod to map internal services, run remotely with explicit DNS and CIDR parameters for external reconnaissance, or attempt AXFR for a quick snapshot when allowed.

Quick Start

Run k8spider all from a shell inside the target environment to enumerate Services via the cluster DNS using the system resolv.conf defaults.

Frequently Asked Questions about k8spider

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate Kubernetes services without API server credentials?▼

You can enumerate Kubernetes services without API credentials by performing DNS queries directly against the cluster DNS. This includes PTR, SRV, and wildcard resolution techniques to discover services and namespaces from a pod or host.

Can I discover internal Kubernetes DNS records from a compromised pod?▼

Yes, you can discover internal Kubernetes DNS records from a compromised pod. By executing a full DNS scan using the pod's local resolv.conf, you map internal services and namespaces without needing elevated privileges or API access.

What is CIDR-based PTR scanning for Kubernetes service discovery?▼

CIDR-based PTR scanning is a technique that sweeps a specified network range using reverse DNS lookups to identify active services. By resolving IP addresses back to internal DNS names, it maps cluster resources without requiring direct API access.

Does Kubernetes DNS zone transfer work for service enumeration?▼

Kubernetes DNS zone transfer (AXFR) can work for service enumeration if the cluster DNS server permits it. Attempting an AXFR provides a quick snapshot of all DNS records, though this is often restricted in hardened cluster environments.

What are the limitations of discovering Kubernetes services via DNS queries?▼

Limitations of DNS-based Kubernetes service discovery include blocked AXFR zone transfers, restricted network policies preventing CIDR PTR sweeps, and incomplete results when services lack exposed SRV records or kube-state-metrics endpoints.

Related Skills

Explore More Software Engineering Skills→
wgpsecwgpsec
1.6k

k8s-network-recon

Automate in-cluster Kubernetes service enumeration with DNS PTR, SRV, AXFR, and K8Spider scans.

Official
Advanced
scitixscitix
225

dns-debug

Diagnose DNS resolution failures in Kubernetes clusters using kubectl.

Official
Intermediate
BrownFineSecurityBrownFineSecurity
811

nmap

Identify open ports and enumerate network services with Nmap.

Official
Advanced
protoLabsAIprotoLabsAI
2

recon-sweep

Perform passive and scoped active reconnaissance on network targets and domains.

Official
Advanced