Package: kubestriker
A Blazing fast Security Auditing tool forKuberentes!!Basic OverviewKubestrikerperforms numerous in depth checks on kubernetes infra to identify thesecurity misconfigurationsand challenges that devops engineers/developers are likely to encounter when using Kubernetes, especially in production and at scale.kubestrikeris Platform agnostic and works equally well across more than one platform such as self hosted kubernetes, EKS, AKS, GKE etc.Table of content⚡ How To InstallClone the repo and installInstall using pipHow to spin up kubestriker container⚡ Types of ScansAuthenticated scansUnauthenticated scansIdentifying an open Insecure port on kuberentes master nodeIdentifying a worker Node with kubelet readwrite and readonly ports open⚡ Current Capabilities⚡ Future improvements⚡ Suggestions⚡ Contributors⚡ Statistics⚡ License⚡ Find me here!!⚡ How To InstallClone the repo and installTo install this tool or clone and run this application, you'll needGit,python3andpipinstalled on your computer. From your command line:# Create python virtual environment$python3-mvenvenv# Activate python virtual environment$sourceenv/bin/activate# Clone this repository$gitclonehttps://github.com/vchinnipilli/kubestriker.git# Go into the repository$cdkubestriker# Install dependencies$pipinstall-rrequirements.txt# Incase of prompt toolkit or selectmenu errors$pipinstallprompt-toolkit==1.0.15$pipinstall-rrequirements.txt# Gearing up Kubestriker$python-mkubestriker# Result will be generated in the current working directory with the name of the targetInstall using pipTo install and run this application, you'll needpipinstalled on your computer. From your command line:# Create python virtual environment$python3-mvenvenv# Activate python virtual environment$sourceenv/bin/activate# Install using pip$pipinstallkubestriker# Incase of prompt toolkit or selectmenu errors$pipinstallprompt-toolkit==1.0.15$pipinstallkubestriker# Gearing up Kubestriker$python-mkubestriker# Result will be generated in the current working directory with the name of the targetHow to spin up kubestriker container# Spinning up the kubestriker Container$dockerrun-it--rm-v/Users/vasantchinnipilli/.kube/config:/root/.kube/config-v"$(pwd)":/kubestriker--namekubestrikercloudsecguy/kubestriker# Replace the user vasantchinnipilli above with your username or absolute path of kube config file$dockerrun-it--rm-v/Users/<yourusername>/.kube/config:/root/.kube/config-v"$(pwd)":/kubestriker--namekubestrikercloudsecguy/kubestriker# Gearing up Kubestriker$python-mkubestriker# Result will be generated in the current working directory with the name of the target⚡ Types of ScansAuthenticated scansAuthenticated scanexpects the user to have atleastread-onlypriviliges and provide a token during the scan. please use the below provided links to create read-only usersCreate read-only user for Amazon eksCreate read-only user for Azure aksCreate read-only user for Google gkeRole based access control# To grab a token from eks cluster$awseksget-token--cluster-namecluster-name--regionap-southeast-2# To grab a token from aks cluster$azaksget-credentials--resource-groupmyResourceGroup--namemyAKSCluster# To grab a token from gke cluster$gcloudcontainerclustersget-credentialsCLUSTER_NAME--zone=COMPUTE_ZONE# To grab a token from service account$kubectl-nnamespacegetsecretserviceaccount-token-ojsonpath='{.data.token}'# To grab a token from a pod directly or via command execution bug$cat/run/secrets/kubernetes.io/serviceaccount/tokenUnauthenticated scansUnauthenticated scanwill be successful incase of anonymous access is permitted on the target clusterIdentifying an open Insecure port on kuberentes master nodeIdentifying a worker Node with kubelet readwrite and readonly ports open⚡ Current CapabilitiesScans Self Managed and cloud provider managed kuberentes infraReconnaissance phase checks for various services or open portsPerforms automated scans incase of insecure, readwrite or readonly services are enabledPerforms both authenticated scans and unauthenticated scansScans for wide range of IAM Misconfigurations in the clusterScans for wide range of Misconfigured containersScans for wide range of Misconfigured Pod Security PoliciesScans for wide range of Misconfigured Network policiesScans the privileges of a subject in the clusterRun commands on the containers and streams back the outputProvides the endpoints of the misconfigured servicesProvides possible privilege escalation detailsElaborative report with detailed explanation⚡ Future improvementsAutomated exploitation based on the issues identifiedapi and cicd automation friendlyA Decent FrontEnd to make the lives easier⚡ SuggestionsKubestriker is an opensource andemailware. Meaning, if you liked using this tool or it has helped you in any way or if you have any suggestions/improvements, I'd like you send me an email atvchinnipilli@gmail.comabout anything you'd want to say about this tool. I'd really appreciate it!⚡ Contributors⚡ Statistics⚡ LicenseThe MIT License⚡ Find me here!!