Topics

Reference materials covering offensive and defensive Kubernetes security techniques

Total

24

MITRE ATT&CK mapped

15

Offensive

14

Defensive

10

Filters the topic cards below as you type.

Showing 24 topics

View:

Browse topics

offensive

Abusing Kyverno MutatingPolicy

How MutatingPolicy access can be abused to change pods during admission in Kyverno

offensive

Cluster Reconnaissance via Prometheus

Querying an unauthenticated Prometheus endpoint to map cluster topology without touching the Kubernetes API

offensive

Compromising etcd via Pod Creation

Steal etcd TLS via pod hostPath on the control plane

offensive

Data Exfiltration via Kubernetes Events

How attackers can misuse Kubernetes Events to move data out after cluster compromise

defensive

Detecting Data Exfiltration via Kubernetes Events

Identifying abuse of the Kubernetes Events API to smuggle data out of a cluster through event message fields

defensive

Detecting Impersonation Abuse

Identifying impersonation abuse by inspecting the impersonatedUser audit field and reviewing which subjects hold the impersonate verb

defensive

Detecting kubectl debug Activity via Audit Logs

Identifying ephemeral container injection and node debug pod creation through API server audit events

defensive

Detecting Orphan Pod Masquerading via Audit Logs

Identifying pods that mimic controller-managed naming patterns but were created directly by a user rather than a controller

defensive

Detecting Permission Enumeration via Audit Logs

Spotting enumeration of current RBAC access by auditing SelfSubjectRulesReview events

defensive

Disable Automatic Mounting of Default Service Account Tokens

Preventing token theft by controlling service account token mounting

defensive

Enforcing Read-Only Container Filesystems

Prevent attackers from writing tools, backdoors, or scripts to a container's filesystem after gaining code execution

defensive

Hiding Services from Enumeration

Preventing internal service discovery by disabling automatic injection of service environment variables

offensive

Internal Cluster Discovery

Techniques for discovering available services, APIs, and potential attack vectors within a Kubernetes cluster

offensive

Kubernetes Impersonation

Abusing the impersonate verb and Impersonate-* headers so the API server authorizes requests as another user, group, or ServiceAccount

offensive

Orphan Pod Masquerading

Creating orphan pods that mimic controller-managed naming conventions to blend in with legitimate workloads

offensive

Passive Secret Discovery via kube-state-metrics

Passively discovering secret names, namespaces, and metadata cluster-wide by querying the unauthenticated kube-state-metrics endpoint

offensive

Persistence via Unbound Service Account Tokens

Using unbound tokens from the TokenRequest API to maintain cluster access after deleting the attacking pod

offensive

Privilege Escalation via serviceaccounts/token Permission

How create permission on the serviceaccounts/token subresource enables acquiring tokens for more privileged service accounts without pods or Secrets

defensive

Restricting Prometheus Endpoint Access

Preventing unauthenticated access to Prometheus metrics that expose cluster topology, pod identities, and internal service addresses

defensive

Securing ArgoCD Application Access

Restrict ArgoCD RBAC, enforce AppProject boundaries, and block privileged workload deployment through the ArgoCD confused deputy attack path

offensive

ServiceAccount Token Theft

Techniques for obtaining ServiceAccount tokens using legitimate Kubernetes features without exploiting vulnerabilities

offensive

Weaponizing ArgoCD Application

Abusing ArgoCD as a confused deputy to deploy disguised privileged workloads cluster-wide and maintain persistent access

offensive

Weaponizing kubectl debug

Why kubectl debug is a privilege escalation path, not just a troubleshooting tool

offensive

Weaponizing Pod Creation Access

How pod creation permissions can be leveraged to escalate privileges and escape to the underlying node