菜单
Attack exposed Kubernetes: API server, kubelet, etcd, dashboards, and RBAC. Load on k8s signals — ports 6443/10250/2379/8443, /api/v1, kube-dns, a pod foothold, or "kubernetes/k8s". Signals: kubectl, service-account tokens, exposed dashboard, container in a cluster.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/NoorQureshi/SploitAgent --skill cloud-kubernetes命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
| name | cloud-kubernetes |
| description | Attack exposed Kubernetes: API server, kubelet, etcd, dashboards, and RBAC. Load on k8s signals — ports 6443/10250/2379/8443, /api/v1, kube-dns, a pod foothold, or "kubernetes/k8s". Signals: kubectl, service-account tokens, exposed dashboard, container in a cluster. |
| domain | cloud |
| type | technique |
| stability | learning |
| modes | ["pentest","bugbounty"] |
| severity | critical |
| owasp | ["A05:2021-Security-Misconfiguration"] |
| cwe | ["CWE-284"] |
| mitre | ["T1610","T1613"] |
| tools | ["kubectl","kube-hunter","peirates"] |
| schema_version | 1 |
A Kubernetes control-plane or node component is reachable (externally or from a pod foothold), or you landed in a container inside a cluster and want to escalate to cluster admin / other tenants.
k8s exposes powerful HTTP APIs that are frequently unauthenticated or over-permissioned: anonymous API access, kubelet read/exec on 10250, unauth etcd (all secrets), and mounted service-account tokens with broad RBAC. One over-scoped token = cluster takeover.
kube-hunter; probe API server 6443 (/api/v1 anonymous), kubelet 10250
(/pods, /run exec), etcd 2379 (keys→secrets), and exposed dashboards (8443/anonymous)./var/run/secrets/kubernetes.io/serviceaccount/;
kubectl auth can-i --list to see what it grants.create pods with a hostPath/privileged spec to mount the node (→ node/cluster takeover).cloud-container-escape).kubectl get secrets -A, cloud IAM via node metadata (→ cloud-imds-ssrf).kubectl auth can-i --list first — it tells you exactly what the token can do; don't guess.Cluster-level access proven: reading secrets across namespaces, exec into others' pods, or node filesystem/cloud-creds access from an over-scoped token.
kube-hunter/peirates; NCC "Kubernetes security"; MITRE ATT&CK Containers.