Kubernetes Attack Surface
Kubernetes presents multiple attack vectors across control plane, node components, and workloads. Understanding each component is essential for comprehensive security testing.
Primary Attack Targets
API Server
Central management endpoint (6443)
etcd
Cluster state storage (2379)
Kubelet
Node agent (10250)
Container Runtime
containerd/CRI-O
Critical Attack Vectors
- Exposed API Server - Anonymous auth, weak RBAC
- Kubelet API (10250) - Unauthenticated command execution
- etcd (2379) - Direct access to all cluster secrets
- Cloud Metadata - 169.254.169.254 credential theft
Penetration Testing Methodology
Assessment Phases
Reconnaissance
External/internal enumeration, cloud metadata access
Vulnerability Discovery
RBAC misconfiguration, exposed services, CVEs
Exploitation
Container escape, token theft, privilege escalation
Post-Exploitation
Lateral movement, persistence, cluster takeover
Reporting
Document findings, risk assessment, remediation
MITRE ATT&CK for Containers
Map your findings to the MITRE ATT&CK framework for standardized threat categorization and comprehensive coverage validation.
Initial Access
Exposed Dashboard, Valid Accounts, Cloud Credentials
Execution
kubectl exec, Kubelet API, Container Admin Commands
Persistence
Create Account, Implant Image, Admission Webhook
Privilege Escalation
CVE Exploitation, RBAC Abuse, Container Escape
Defense Evasion
Disable Admission Controllers, Log Tampering
Credential Access
SA Tokens, Secrets, Cloud Metadata, etcd Dump
Security Assessment Checklist
K8s Penetration Test Coverage
Reconnaissance
Authentication
Container Security
Network
Pentesting Focus Areas
Common Vulnerabilities Found
Essential Pentesting Tools
Reconnaissance
- kube-hunter
- kubectl plugins
- Shodan/Censys
- nmap for K8s ports
Exploitation
- Peirates
- kubeletctl
- kubesploit
- kdigger
Key Takeaway
Kubernetes penetration testing requires understanding both orchestration platform vulnerabilities and container security fundamentals. Default configurations are insecure—explicit hardening is required.
Tags
Written by
Asfaleia Team
Security Consultant
Kubernetes security specialist with expertise in container orchestration and cloud-native penetration testing.