hunt-k8s

Fingerprint the API server with curl against /version on port 6443, then submit a SelfSubjectRulesReview to determine actual granted verbs. A 200 response alone is not proof of privilege, so confirm impact by reading a real Secret value before reporting.

Use the /run endpoint with a POST containing cmd=id, which returns command output directly without stream handling. The /exec endpoint is a SPDY/WebSocket stream that returns a 302 redirect, so use kubeletctl or websocat to follow the stream rather than a plain POST.

Port 10250 is the authenticated HTTPS kubelet endpoint that supports /run and /exec for command execution. Port 10255 is the read-only HTTP endpoint exposing only /pods, /stats, and /metrics, so it constitutes information disclosure and cannot yield RCE.

No, modern projected tokens are bound to a specific audience and have short expiry around one hour. Decode the token and check the aud and exp claims, since a token issued for Vault or OIDC will not authenticate to the API server.

CVEs like CVE-2018-1002105 and CVE-2024-21626 are version-gated, so you must confirm gitVersion or the runc version before asserting exploitability. A version match is only a lead; working proof-of-concept output is the actual proof.

Confirm blind or outbound vectors with an out-of-band channel such as Burp Collaborator or interactsh, triggering a curl from inside the pod via /run to your unique subdomain. A delayed response or echoed URL alone is not valid proof of the hop.