CVE-2024-23653

root@kitploit: syntax=docker.io/zdfa/evilerfile FROM alpine RUN grep Cap /proc/self/status root@kitploit: sudo bin/buildctl build \ --frontend=dockerfile.v0 \ --local context=. \ --local dockerfile=. root@kitploit: ➜ cp sudo bin/buildctl build \ --frontend=dockerfile.v0 \ --local context=. ...

CVE-2024-21626

CVE-2024-21626 For detailed explanation for this vulnerability, plz refer to my article. Exploit Exploit via Running a Container No need to build a custom image, just run a container with -w parameter: root@kitploit: docker run -w /proc/self/fd/8 --name cve-2024-21626 --rm -it debian:bookworm...

kata-cve-2020-2023-poc

kata-cve-2020-2023-poc 1. Reproduce Environment Note: The environment needs support KVM https://github.com/ssst0n3/dockerarchive/tree/branchubuntu-20.04docker-ce-19.03.11containerd.io-1.4.9kata-1.11.0 root@kitploit: $ git clone https://github.com/ssst0n3/dockerarchive.git $ cd dockerarchive $ git...

pisc

Public OCI-Image Security Checker What is it? PISC Public OCI-Image or docker-image Security Checker is command-line tool to assess the security of OCI container images. Exits with code 1 if any of the following conditions are met: malware 🍄 exploits 🐙, hack-tools 👾, backdoors 🐴, crypto-miners 💰,...

peirates

Peirates What is Peirates? Peirates, a Kubernetes penetration tool, enables an attacker to escalate privilege and pivot through a Kubernetes cluster. It automates known techniques to steal and collect service account tokens, secrets, obtain further code execution, and gain control of the cluster...

CVE-2019-5736-Dockerattack-and-security-mechanism

CVE-2019-5736-attack-and-security-mechanism In this project, we found a recent attack through the malicious container and implemented a security mechanism to stop it. Introduction Cyber-attacks have become a critical challenge for both companies and small businesses, largely due to vulnerabilitie...

cve-2018-9207

CVE-2018-9207 This is part of Cved: a tool to manage vulnerable docker containers. Cved: https://github.com/git-rep-src/cved Image source: https://github.com/cved-sources/cve-2018-9207 Image author: https://github.com/lcashdol/Exploits/tree/master/CVE-2018-9207...

CVE-2024-21626-POC

CVE-2024-21626-PoC Usage Instructions For educational/research purposes only. Any use unrelated to education/research is at your own risk. Usage root@kitploit: docker build . -t cve-2024-21626 docker run -it --rm cve-2024-21626 bash /poc.sh 另起一个terminal /bin/bash.copy Note The specific file...

vesta

A static analysis of vulnerabilities, Docker and Kubernetes cluster configuration detect toolkit based on the real penetration of cloud computing. English · 简体中文 Overview Vesta is a static analysis of vulnerabilities, Docker and Kubernetes cluster configuration detect toolkit. It inspects...

hardening-k8s-containers

Intentionally Vulnerable Note Taking Application This repository contains a very simple and vulnerable application used to demonstrate the differences between deploying this application with the default settings to a Kubernetes cluster, versus adding some extra security settings that WILL NOT fix...

CVE-2026-87055

A flaw was found in operator-sdk-builder. The software uses a flexible label, called a mutable tag, to identify its base container image instead of a unique, fixed identifier. This practice allows the underlying base image to change unexpectedly between builds. Such a change could introduce...

bad_garbage

BADGARBAGE.c CVE-2026-53361 — an unprivileged, container-escapable use-after-free in the AFUNIX socket garbage collector. This is the single-vector MSGPEEK only version. The Bug The AFUNIX GC reclaims "in-flight" sockets that form unreachable reference cycles. A concurrent MSGPEEK on an in-flight...

osint_toolkit

OSINT Toolkit Warning OSINT Toolkit is not production ready yet. This is an early prototype, that still needs some work to be done. A fullstack web application built for security analysts OSINT Toolkit is a self-hostable, on-demand analysis platform designed for security specialists. It...

cve-2014-6271

CVE-2014-6271 This is part of Cved: a tool to manage vulnerable docker containers. Cved: https://github.com/git-rep-src/cved Image source: https://github.com/cved-sources/cve-2014-6271 Image author: https://github.com/Medicean/VulApps/tree/master/b/bash/shellshock1CVE-2014-6271...

cve-2019-9194

CVE-2019-9194 This is part of Cved: a tool to manage vulnerable docker containers. Cved: https://github.com/git-rep-src/cved Image source: https://github.com/cved-sources/cve-2019-9194 Image author: https://github.com/cved-sources/cve-2019-9194...

csf

ArmourBird CSF - Container Security Framework Note: The CSF Client is under active development and is getting converted into GoLang for better performace and architecture Table of Contents 1. About 2. Architecture Diagram 3. APIs-CSF Server 4. Installation/Usage 5. Building Docker Images 6. Sneak...

csf

ArmourBird CSF - 容器安全框架 注意： CSF 客户端正在积极开发中，并正在转换为 GoLang 以获得更好的性能和架构。 目录 1. 关于 2. 架构图 3. API - CSF 服务器 4. 安装/使用 5. 构建 Docker 镜像 6. 预览 7. 待办事项 8. 网站 9. Twitter 10. 参考资料 关于 ArmourBird CSF - 容器安全框架 是一个可扩展、模块化、API 优先的框架，用于对 Docker 安装和容器进行定期的安全监控，支持 CIS 及其他自定义安全检查。 ArmourBird CSF 采用客户端-服务器架构，因此分为两个组件：...

cve-2017-7494

CVE-2017-7494 This is part of Cved: a tool to manage vulnerable docker containers. Cved: https://github.com/git-rep-src/cved Image source: https://github.com/cved-sources/cve-2017-7494 Image author: https://github.com/opsxcq/exploit-CVE-2017-7494...

CVE-2026-87054

A flaw was found in operator-sdk-builder. The containers-policy.json configuration file defaults to insecureAcceptAnything for container image registries that are not explicitly listed. This default setting causes signature verification to be entirely skipped for images pulled from these unlisted...

CVE-2026-87053

A flaw was found in operator-sdk-builder. Due to an oversight in the Containerfile configuration, the final built container image runs with root privileges by default. This increases the attack surface of the container, as any process executed within it will have elevated permissions. If a...