| name | performing-kubernetes-penetration-testing |
| description | Systematically evaluate Kubernetes cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets, using tools like kube-hunter, Kubescape, peirates, and manual kubectl exploitation to identify misconfigurations leading to cluster compromise. Use for authorized penetration tests or hands-on validation of Kubernetes security controls. |
| domain | cybersecurity |
| subdomain | container-security |
| tags | ["containers","kubernetes","security","penetration-testing","offensive-security"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"] |
| mitre_attack | ["T1610","T1611","T1609","T1525"] |
Performing Kubernetes Penetration Testing
Overview
Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools like kube-hunter, Kubescape, peirates, and manual kubectl exploitation, testers identify misconfigurations that could lead to cluster compromise.
When to Use
- When conducting security assessments that involve performing kubernetes penetration testing
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Prerequisites
- Authorized penetration testing engagement
- Kubernetes cluster access (various levels for different test scenarios)
- kube-hunter, kubescape, kube-bench installed
- kubectl configured
- Network access to cluster components
Core Concepts
Kubernetes Attack Surface
| Component | Port | Attack Vectors |
|---|
| API Server | 6443 | Auth bypass, RBAC abuse, anonymous access |
| Kubelet | 10250/10255 | Unauthenticated access, command execution |
| etcd | 2379/2380 | Unauthenticated read, secret extraction |
| Dashboard | 8443 | Default credentials, token theft |
| NodePort Services | 30000-32767 | Service exposure, application exploits |
| CoreDNS | 53 | DNS spoofing, zone transfer |
MITRE ATT&CK for Kubernetes
| Phase | Techniques |
|---|
| Initial Access | Exposed Dashboard, Kubeconfig theft, Application exploit |
| Execution | exec into container, CronJob, deploy privileged pod |
| Persistence | Backdoor container, mutating webhook, static pod |
| Privilege Escalation | Privileged container, node access, RBAC abuse |
| Defense Evasion | Pod name mimicry, namespace hiding, log deletion |
| Credential Access |
