kube-bench

kube-bench is a tool that checks whether Kubernetes is deployed securely by running the checks documented in the...

botb

Break out the Box BOtB BOtB 是一款容器分析与利用工具，专为渗透测试工程师和普通工程师设计，同时支持常见的 CI/CD 技术，便于集成到持续集成/持续部署流程中。 它能做什么？ BOtB 是一款 CLI 工具，能够让你： 利用常见的容器漏洞 执行常见的容器后渗透操作 当容器内缺少某些工具或二进制文件时提供替代能力 结合 CI/CD 技术使用 BOtB 的能力测试容器部署 以手动或自动方式执行上述操作 当前能力 通过暴露的 Docker 守护进程（docker.sock）实现容器逃逸 通过 CVE-2019-5736 实现容器逃逸 通过启用 CAPS 和...

kubernetes-goat

Kubernetes Goat ✨ Kubernetes Goat 旨在成为一个故意存在漏洞的集群环境，用于学习和实践 Kubernetes 安全性 🚀 🙌 请参阅 https://madhuakula.com/kubernetes-goat 获取指南 📖 🧰 设置 Kubernetes Goat 确保你拥有集群的管理员权限并安装了 kubectl。请参阅 安装文档 确保你安装了 helm 包管理器。请参阅 安装文档 要在你的集群中设置 Kubernetes Goat 资源，运行以下命令： root@kitploit: git clone...

subpath-exploit

Sample Kubernetes Escape via CVE-2017-1002101 Description After hearing about the issue and following this guide, I wanted to explore things a bit more. This repo contains a couple pod deployments and helper shell scripts that demonstrate the attack mechanism in the simplest way possible so that...

poc_CVE-2018-1002105

CVE-2018-1002105 PoC Authenticated PoC Demo Usage Unauthenticated PoC Demo Usage Authenticated PoC Proof-of-Concept exploit for CVE-2018-1002105. The current exploit requires create and get privileges on pods and pods/exec. Support has been added for portforward and attach, which require similar...

kube-trivy

A Simple and Comprehensive Vulnerability Scanner for Kubernetes Abstract KubeTrivy is a extends trivy for kubernetes. KubeTrivy is a simple and comprehensive vulnerability scanner for Kubernetes. KubeTrivy detects vulnerabilities of OS packages Alpine, RHEL, CentOS, etc. and application...

kubeeye

English | 中文 KubeEye 是为 Kubernetes 设计的云原生集群巡检工具，用于根据自定义规则发现 Kubernetes 集群中存在的问题及风险。 快速开始 安装 可从 Releases 中下载安装包（其中包含helm chart，demo rules 以及 供离线环境部署的镜像） root@kitploit: VERSION=v1.0.3 wget https://github.com/kubesphere/kubeeye/releases/download/$VERSION/kubeeye-offline-$VERSION.tar.gz tar -zxvf...

kubeeye

English | 中文 KubeEye is a cloud-native cluster inspection tool specifically designed for Kubernetes, capable of identifying issues and risks within the Kubernetes cluster based on custom rules. QuickStart Installation Download the installation package from Releases, which includes Helm chart, dem...

kube-monkey

kube-monkey es una implementación de Chaos Monkey de Netflix para clústeres de Kubernetes. Elimina aleatoriamente pods de Kubernetes k8s en el clúster, fomentando y validando el desarrollo de servicios resilientes a fallos. Únete a nosotros en kube-monkey en Kubernetes Slack. kube-monkey se ejecu...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.13 bug fix and security update

Red Hat OpenShift Container Platform release 4.22.13 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...

kube-hunter

注意 kube-hunter 已不再处于积极开发阶段。如果你对扫描 Kubernetes 集群中的已知漏洞感兴趣，我们建议使用 Trivy。具体来说，Trivy 的 Kubernetes 配置错误扫描 和 KBOM 漏洞扫描 功能。了解更多信息，请参阅 Trivy 文档。 kube-hunter 用于在 Kubernetes 集群中搜寻安全弱点。该工具旨在提高对 Kubernetes 环境中安全问题的认识和可见性。你不应该在你不拥有的 Kubernetes 集群上运行 kube-hunter！ 运行 kube-hunter ：kube-hunter...

kube-hunter

Notice kube-hunter is not under active development anymore. If you're interested in scanning Kubernetes clusters for known vulnerabilities, we recommend using Trivy. Specifically, Trivy's Kubernetes misconfiguration scanning and KBOM vulnerability scanning. Learn more in the Trivy Docs. kube-hunt...

cve-2022-0185-crash-poc

Container running cve-2022-0185 crash POC This is a docker container that runs the crash POC from https://www.willsroot.io/2022/01/cve-2022-0185.html. The container runs unprivileged as UID 65534. You can also use docker run -u or set a security context with RunAsUser additionally, all should yie...

CVE-2021-25735

CVE-2021-25735 Exploit CVE-2021-25735: Kubernetes Validating Admission Webhook Bypass Set the Vulnerable Environment Let's start with running the script gencerts.sh to generate TLS certificates and keys. bash gencerts.sh To deploy the admission controller you need to build the Docker container...

peirates

Peirates Peirates 是什么？ Peirates 是一款 Kubernetes 渗透测试工具，使攻击者能够提升权限并在 Kubernetes 集群中横向移动。它自动化了已知的攻击技术，用于窃取和收集服务账户令牌、机密信息，获取进一步的代码执行能力，并最终控制整个集群。 在哪里运行 Peirates？ 你可以在运行于 Kubernetes 上的容器中运行 Peirates，也可以在 Kubernetes 节点上（容器外部）运行。 Peirates 会攻击 Kubernetes 集群吗？ 是的，它绝对会。在 Kubernetes...

CVE-2026-77968 Hawtio-operator: hawtio-operator: cluster-wide secrets read/write granted to operator serviceaccount

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: create, get, list, update, watch across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in th...

CVE-2026-77968

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: create, get, list, update, watch across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in th...

CVE-2026-40564

CVE-2026-40564: SSRF a través de FlinkSessionJob.spec.job.jarURI en flink-kubernetes-operator El operador Apache Flink Kubernetes no verifica el campo spec.job.jarURI en los recursos FlinkSessionJob o FlinkDeployment. Cualquier persona que pueda crear uno de esos recursos puede establecer jarURI ...

CVE-2022-27518_POC

CVE-2022-27518POC root@kitploit: docker pull quay.io/citrix/citrix-k8s-cpx-ingress:13.0-58.30 Use the following command to verify if CPX image is installed in docker images root@kitploit: docker images | grep 'citrix-k8s-cpx-ingress' Use the following command to create a CPX container instance...

installer

概述 安装 mql cnspec 扫描目标平台 包信息 Kubernetes 状态 Docker 容器: Homebrew: Install.sh: Install.ps1: macOS Pkg: Arch Linux: 安装 安装 mql 和 cnspec 最简单的方法是使用安装脚本。 通过 Shell 脚本（Linux 和 macOS） https://install.mondoo.com/sh root@kitploit: bash -c "$curl -sSL https://install.mondoo.com/sh" 通过 PowerShell（Windows）...