| name | cloud-kubernetes |
| description | Attack exposed Kubernetes: API server, kubelet, etcd, dashboards, and RBAC. Load on k8s signals — ports 6443/10250/2379/8443, /api/v1, kube-dns, a pod foothold, or "kubernetes/k8s". Signals: kubectl, service-account tokens, exposed dashboard, container in a cluster.
|
| domain | cloud |
| type | technique |
| stability | learning |
| modes | ["pentest","bugbounty"] |
| severity | critical |
| owasp | ["A05:2021-Security-Misconfiguration"] |
| cwe | ["CWE-284"] |
| mitre | ["T1610","T1613"] |
| tools | ["kubectl","kube-hunter","peirates"] |
| schema_version | 1 |
Kubernetes attacks
When it applies
A Kubernetes control-plane or node component is reachable (externally or from a pod foothold),
or you landed in a container inside a cluster and want to escalate to cluster admin / other tenants.
Why it works
k8s exposes powerful HTTP APIs that are frequently unauthenticated or over-permissioned:
anonymous API access, kubelet read/exec on 10250, unauth etcd (all secrets), and mounted
service-account tokens with broad RBAC. One over-scoped token = cluster takeover.
Method
- From outside:
kube-hunter; probe API server 6443 (/api/v1 anonymous), kubelet 10250
(/pods, /run exec), etcd 2379 (keys→secrets), and exposed dashboards (8443/anonymous).
- From a pod: read the mounted token
/var/run/secrets/kubernetes.io/serviceaccount/;
kubectl auth can-i --list to see what it grants.
- Escalate via RBAC: over-permissioned SA → create/exec pods, read secrets across namespaces,
or
create pods with a hostPath/privileged spec to mount the node (→ node/cluster takeover).
- Container→node breakout: privileged pod, hostPID/hostNetwork, or a hostPath mount to the
host filesystem (→
cloud-container-escape).
- Loot:
kubectl get secrets -A, cloud IAM via node metadata (→ cloud-imds-ssrf).
Gotchas
kubectl auth can-i --list first — it tells you exactly what the token can do; don't guess.- Anonymous API/kubelet is common in labs and misconfigured clusters — always test unauth.
- On bug bounty, prove access read-only where possible; creating privileged pods is high-impact — mind RoE.
Verify success
Cluster-level access proven: reading secrets across namespaces, exec into others' pods, or node
filesystem/cloud-creds access from an over-scoped token.
References
kube-hunter/peirates; NCC "Kubernetes security"; MITRE ATT&CK Containers.
