What problem does it solve?
This Skill helps you identify and exploit common Kubernetes misconfigurations and access-control weaknesses during authorized security testing, so you can determine real cluster impact rather than relying on generic checklists.
Core Features & Use Cases
- Kubernetes API, RBAC, and auth-path validation: Verify anonymous access, token/cert usage, and enumerate effective permissions to map escalation paths.
- Service account and secret compromise: Locate mounted service account credentials, decode JWTs, and abuse token generation or overprivileged permissions.
- Deep cluster attack surface coverage: Probe etcd directly, target Kubelet endpoints for RBAC bypass, and assess kubelet/node and admission-webhook bypass conditions.
- Cloud metadata abuse: Test IMDS/metadata endpoints (EKS/GKE/AKS) from within workloads to determine whether cloud credentials are reachable.
- Network and registry-driven pivoting: Enumerate NetworkPolicies and extract container registry pull secrets to find additional credentials and lateral movement opportunities.
What you can do in practice?
During a Kubernetes engagement, you can start from an in-cluster foothold (or exposed endpoints), enumerate RBAC, determine whether etcd/Kubelet are reachable, and then validate whether the cluster is vulnerable to token abuse, node escape chains, webhook bypass, or cloud metadata credential theft.
Quick Start
Use the kubernetes-pentesting skill to assess whether a compromised pod can escalate privileges by enumerating RBAC, checking Kubelet and etcd exposure, and probing cloud metadata access paths.
