litmus

LitmusChaos Open Source Chaos Engineering Platform Read this inother languages. 🇰🇷 🇨🇳 🇧🇷 🇮🇳 🇪🇸 Overview LitmusChaos is an open source Chaos Engineering platform that enables teams to identify weaknesses & potential outages in infrastructures by inducing chaos tests in a controlled way. Developers &...

CVE-2022-27518_POC

CVE-2022-27518POC root@kitploit: docker pull quay.io/citrix/citrix-k8s-cpx-ingress:13.0-58.30 Use the following command to verify if CPX image is installed in docker images root@kitploit: docker images | grep 'citrix-k8s-cpx-ingress' Use the following command to create a CPX container instance...

botb

Salir de la Caja BOtB BOtB es una herramienta de análisis y explotación de contenedores diseñada para ser utilizada por pentesters e ingenieros, además de ser compatible con CI/CD usando tecnologías CI/CD comunes. ¿Qué hace? BOtB es una herramienta de línea de comandos que te permite: Explotar...

kube-monkey

kube-monkey is an implementation of Netflix's Chaos Monkey for Kubernetes clusters. It randomly deletes Kubernetes k8s pods in the cluster encouraging and validating the development of failure-resilient services. Join us at kube-monkey on Kubernetes Slack. kube-monkey runs at a pre-configured hou...

conftest

Conftest Conftest helps you write tests against structured configuration data. Using Conftest you can write tests for your Kubernetes configuration, Tekton pipeline definitions, Terraform code, Serverless configs or any other config files. Conftest uses the Rego language from Open Policy Agent fo...

CVE-2026-21019-Kubernetes-CronJob-Suspended-Execution-via-Time-Manipulation

CVE-2026-21019 – Kubernetes CronJob Suspended Execution via Time Manipulation Program Code YAML + Python exploit root@kitploit: cronjobvuln.yaml - CronJob that checks current time without external validation apiVersion: batch/v1 kind: CronJob metadata: name: backup spec: schedule: "0 2 "...

subpath-exploit

Sample Kubernetes Escape via CVE-2017-1002101 Description After hearing about the issue and following this guide, I wanted to explore things a bit more. This repo contains a couple pod deployments and helper shell scripts that demonstrate the attack mechanism in the simplest way possible so that...

cve-2022-0185-crash-poc

Container running cve-2022-0185 crash POC This is a docker container that runs the crash POC from https://www.willsroot.io/2022/01/cve-2022-0185.html. The container runs unprivileged as UID 65534. You can also use docker run -u or set a security context with RunAsUser additionally, all should yie...

kubeeye

Inglés | 中文 KubeEye es una herramienta de inspección de clústeres nativa de la nube diseñada específicamente para Kubernetes, capaz de identificar problemas y riesgos dentro del clúster de Kubernetes basándose en reglas personalizadas. Inicio rápido Instalación Descargue el paquete de instalación...

kubeeye

English | 中文 KubeEye is a cloud-native cluster inspection tool specifically designed for Kubernetes, capable of identifying issues and risks within the Kubernetes cluster based on custom rules. QuickStart Installation Download the installation package from Releases, which includes Helm chart, dem...

aws-iam-authenticator

AWS IAM Authenticator for Kubernetes A tool to use AWS IAM credentials to authenticate to a Kubernetes cluster. The initial work on this tool was driven by Heptio. The project receives contributions from multiple community engineers and is currently maintained by Heptio and Amazon EKS OSS...

EUVD-2026-75427

Traefik is a HTTP reverse proxy and load balancer. In versions = v3.7.0 and = v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creat...

CVE-2026-88877

This CRITICAL (CVSS 3.1: 9.8) vulnerability affects Traefik v3.7.0 through v3.7.11, specifically its Kubernetes ingress-nginx provider . When an Ingress carries both an authentication annotation and the from-to-www-redirect annotation, the provider creates a "sibling" router that matches on host ...

CVE-2026-88877 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect

Traefik is a HTTP reverse proxy and load balancer. In versions = v3.7.0 and = v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creat...

kubernetes-goat

Kubernetes Goat ✨ Kubernetes Goat está diseñado para ser un entorno de clúster intencionalmente vulnerable para aprender y practicar seguridad en Kubernetes 🚀 🙌 Consulta https://madhuakula.com/kubernetes-goat para la guía 📖 🧰 Configuración de Kubernetes Goat Asegúrate de tener acceso de...

cve-2018-1002105

This was modified from https://gravitational.com/blog/kubernetes-websocket-upgrade-security-vulnerability/. All credit goes to the kind folks at Gravitational. The original PoC code was modified to go a bit beyond checking for vulnerability and to actually run a command inside the first container...

gvisor

What is gVisor? gVisor provides a strong layer of isolation between running applications and the host operating system. It is an application kernel that implements a Linux-like interface. Unlike Linux, it is written in a memory-safe language Go and runs in userspace. gVisor includes an runtime...

CVE-2025-1974

Kubernetes Ingress-NGINX Unauthenticated Remote Code Execution CVE-2025-1974 Ingress-NGINX: An ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer The "IngressNightmare" vulnerability CVE-2025-1974 stems from a critical flaw in the Ingress-NGINX Admission Controller...

peirates

Peirates What is Peirates? Peirates, a Kubernetes penetration tool, enables an attacker to escalate privilege and pivot through a Kubernetes cluster. It automates known techniques to steal and collect service account tokens, secrets, obtain further code execution, and gain control of the cluster...

tetragon

El nuevo componente Tetragon de Cilium permite una potente observabilidad de seguridad y aplicación en tiempo real basada en eBPF. Tetragon detecta y puede reaccionar ante eventos de seguridad significativos, como Eventos de ejecución de procesos Actividad de llamadas al sistema Actividad de E/S...