kubernetes-pentesting

Enumerate RBAC permissions and exploit service account tokens in Kubernetes clusters.

Updated Jun 11, 2026

Search Tags:#security #RBAC #kubernetes #pentesting #etcd #service account #pod escape

Ready to run

npx skills add https://github.com/utsavthakur/agenticskills --skill kubernetes-pentesting-utsavthakur

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: kubernetes-pentesting
Source: https://github.com/utsavthakur/agenticskills/tree/main/kubernetes-pentesting
Command: npx skills add https://github.com/utsavthakur/agenticskills --skill kubernetes-pentesting-utsavthakur

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires kubectl, kube-hunter, peirates, kubesploit, cdk, kubeletctl, kubeaudit, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill provides an expert-level Kubernetes penetration testing playbook, designed for targeting Kubernetes clusters through various attack vectors and methods.

Core Features & Use Cases

Kubernetes Penetration Testing: A comprehensive set of expert techniques for testing and exploiting Kubernetes clusters.
API Server Access: Includes methods for anonymous access checks, token-based authentication, and certificate-based authentication.
RBAC Enumeration: Enumerates roles and permissions, including dangerous permissions that can lead to RBAC escalation.
Service Account Token Abuse: Offers techniques for accessing service account tokens and using them for escalation.
ETCD Direct Access: Demonstrates methods to check and exploit direct access to the etcd service.
Pod Escape to Node: Includes various methods for escaping from a pod to the underlying node.
Kubelet API: Offers methods for interacting with the Kubelet API on the node.
Cloud-Specific Attacks: Provides strategies for attacking Kubernetes deployed on cloud platforms like AWS, GCP, and Azure.
Admission Webhook Bypass: Describes methods to bypass admission webhooks.
Container Registry Access: Demonstrates methods for extracting pull secrets from container registries.
Network Policy Enumeration & Bypass: Provides methods for enumerating network policies and bypassing them.
Tools: Lists various tools that can be used for Kubernetes penetration testing.
Kubernetes Pentesting Decision Tree: Offers a step-by-step guide to perform a pentest on Kubernetes clusters.

Quick Start

Use the kubernetes-pentesting skill to enumerate and exploit permissions within a Kubernetes cluster using RBAC and token abuse.

Frequently Asked Questions about kubernetes-pentesting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I enumerate Kubernetes RBAC permissions to find escalation paths?▼

Kubernetes RBAC enumeration involves querying the API server for roles and bindings to identify dangerous permissions that can lead to RBAC escalation. This Skill provides techniques to enumerate and exploit these permissions using service account tokens.

What is the best way to escape a Kubernetes pod to the underlying node?▼

Pod escape techniques target the underlying node by exploiting container misconfigurations or exposed APIs like the Kubelet API. This Skill provides various methods for escaping from a pod to the node and interacting with node components.

Can I use kube-hunter and peirates for Kubernetes cluster penetration testing?▼

Yes, kube-hunter and peirates are included as dependencies for Kubernetes penetration testing. This Skill integrates these tools alongside kubesploit, cdk, kubeletctl, and kubeaudit to target API servers, etcd, and service accounts.

How do I access etcd directly during a Kubernetes pentest?▼

Direct etcd access involves checking and exploiting the etcd service to read or modify cluster state data. This Skill demonstrates methods to check for direct access and extract secrets or configurations from etcd.

Does this Kubernetes pentesting playbook cover cloud-specific attacks on AWS, GCP, and Azure?▼

Yes, this Skill provides strategies for attacking Kubernetes clusters deployed on cloud platforms like AWS, GCP, and Azure. It includes techniques for extracting container registry pull secrets and bypassing admission webhooks.

How do I bypass Kubernetes network policies during a security assessment?▼

Network policy enumeration and bypass methods are provided to circumvent traffic restrictions within the cluster. This Skill offers techniques for enumerating existing network policies and bypassing them to access restricted services.