performing-kubernetes-penetration-testing

What problem does it solve? Kubernetes clusters often ship with misconfigurations—exposed API servers, overly permissive RBAC, unprotected etcd, and missing network policies—that attackers can exploit. This Skill provides a structured, step-by-step penetration testing workflow to systematically identify these weaknesses before adversaries do. ## Core Features & Use Cases - Attack Surface Mapping: Enumerate exposed components including the API server (6443), kubelet (10250/10255), etcd (2379), and NodePort services using nmap and curl probes. - Automated Vulnerability Scanning: Run kube-hunter, kube-bench, and Kubescape against CIS, NSA, and MITRE ATT&CK frameworks to detect misconfigurations at scale. - Hands-On Exploitation Testing: Validate RBAC privilege escalation paths, extract secrets, deploy privileged test pods, and verify network policy enforcement. - Use Case: During an authorized engagement against a production cluster, follow the workflow to discover an anonymously accessible API server, confirm excessive service account permissions with kubectl auth can-i, and document the full attack path for remediation. ## Quick Start Ask the agent to perform a Kubernetes penetration test against your authorized target cluster, starting with external reconnaissance and kube-hunter scanning.