# Kubestriker | A Blazing Fast Security Auditing Tool For Kubernetes

**URL:** <https://onehack.st/t/kubestriker-a-blazing-fast-security-auditing-tool-for-kubernetes/174483>\
**Category:** Tools & Scripts\
**Tags:** learning, tools, programming\
**Created:** [March 6, 2021, 10:55am UTC](https://onehack.st/t/kubestriker-a-blazing-fast-security-auditing-tool-for-kubernetes/174483 "2021-03-06T10:55:59Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [March 6, 2021, 10:56am UTC](https://onehack.st/t/kubestriker-a-blazing-fast-security-auditing-tool-for-kubernetes/174483/1 "2021-03-06T10:56:00Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/4/0/40b44693e378613651f37b8912ab1c262e973964.png)

**Kubestriker** performs numerous in depth checks on kubernetes infra to identify the **security misconfigurations** and challenges that devops engineers/developers are likely to encounter when using Kubernetes, especially in production and at scale.

**kubestriker** is Platform agnostic and works equally well across more than one platform such as self hosted [kubernetes](https://kubernetes.io/), [Amazon EKS](https://aws.amazon.com/eks), [Azure AKS](https://azure.microsoft.com/en-us/services/kubernetes-service/), [Google GKE](https://cloud.google.com/kubernetes-engine) etc.

[![](https://raw.githubusercontent.com/vchinnipilli/kubestriker/master/media/pip-install.gif)](https://raw.githubusercontent.com/vchinnipilli/kubestriker/master/media/pip-install.gif)

## How To Install

### Clone the repo and install

To install this tool or clone and run this application, you’ll need [Git](https://git-scm.com/), [python3](https://www.python.org/downloads/) and [pip](https://pypi.org/project/pip/) installed on your computer. It is advised you install this tool in [virtual environment](https://virtualenv.pypa.io/en/latest/installation.html)

From your command line:

# Create python virtual environment $ python3 -m venv env # Activate python virtual environment $ source env/bin/activate # Clone this repository $ git clone [https://github.com/vchinnipilli/kubestriker.git](https://github.com/vchinnipilli/kubestriker.git) # Go into the repository $ cd kubestriker # Install dependencies $ pip install -r requirements.txt # Incase of prompt toolkit or selectmenu errors $ pip install prompt-toolkit==1.0.15 $ pip install -r requirements.txt # Gearing up Kubestriker $ python -m kubestriker # Result will be generated in the current working directory with the name of the target

### Install using pip

To install and run this application, you’ll need [pip](https://pypi.org/project/pip/) installed on your computer. From your command line:

# Create python virtual environment $ python3 -m venv env # Activate python virtual environment $ source env/bin/activate # Install using pip $ pip install kubestriker # Incase of prompt toolkit or selectmenu errors $ pip install prompt-toolkit==1.0.15 $ pip install kubestriker # Gearing up Kubestriker $ python -m kubestriker # Result will be generated in the current working directory with the name of the target

### How to spin up kubestriker container

[Use this link to view the Kubestriker container latest releases](https://hub.docker.com/repository/docker/cloudsecguy/kubestriker)

# Spinning up the kubestriker Container $ docker run -it --rm -v /Users/vasantchinnipilli/.kube/config:/root/.kube/config -v “$(pwd)”:/kubestriker --name kubestriker cloudsecguy/kubestriker:v1.0.0 # Replace the user vasantchinnipilli above with your username or absolute path of kube config file $ docker run -it --rm -v /Users//.kube/config:/root/.kube/config -v “$(pwd)”:/kubestriker --name kubestriker cloudsecguy/kubestriker:v1.0.0 # Gearing up Kubestriker $ python -m kubestriker # Result will be generated in the current working directory with the name of the target

[![](https://raw.githubusercontent.com/vchinnipilli/kubestriker/master/media/docker.gif)](https://raw.githubusercontent.com/vchinnipilli/kubestriker/master/media/docker.gif)

## Types of Scans

### Authenticated scans

**Authenticated scan** expects the user to have atleast **read-only** privileges and provide a token during the scan. please use the below provided links to create read-only users

[Create read-only user for Amazon eks](https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html)  
[Create read-only user for Azure aks](https://docs.microsoft.com/en-us/azure/aks/control-kubeconfig-access)  
[Create read-only user for Google gke](https://cloud.google.com/kubernetes-engine/docs/how-to/iam)  
[Create a subject using Role based access control](https://medium.com/@rschoening/read-only-access-to-kubernetes-cluster-fcf84670b698)

# To grab a token from eks cluster $ aws eks get-token --cluster-name cluster-name --region ap-southeast-2 # To grab a token from aks cluster $ az aks get-credentials --resource-group myResourceGroup --name myAKSCluster # To grab a token from gke cluster $ gcloud container clusters get-credentials CLUSTER\_NAME --zone=COMPUTE\_ZONE # To grab a token from service account $ kubectl -n namespace get secret serviceaccount-token -o jsonpath=‘{.data.token}’ # To grab a token from a pod directly or via command execution bug $ cat /run/secrets/kubernetes.io/serviceaccount/token

### Unauthenticated scans

**Unauthenticated scan** will be successful incase of anonymous access is permitted on the target cluster

#### Identifying an open Insecure port on kubernetes master node

[![](https://raw.githubusercontent.com/vchinnipilli/kubestriker/master/media/insecure_port.gif)](https://raw.githubusercontent.com/vchinnipilli/kubestriker/master/media/insecure_port.gif)

#### Identifying a worker Node with kubelet readwrite and readonly ports open

[![](https://raw.githubusercontent.com/vchinnipilli/kubestriker/master/media/node_scan.gif)](https://raw.githubusercontent.com/vchinnipilli/kubestriker/master/media/node_scan.gif)

## Current Capabilities

- Scans Self Managed and cloud provider managed kubernetes infra
- Reconnaissance phase checks for various services or open ports
- Performs automated scans incase of insecure, readwrite or readonly services are enabled
- Performs both authenticated scans and unauthenticated scans
- Scans for wide range of IAM Misconfigurations in the cluster
- Scans for wide range of Misconfigured containers
- Scans for wide range of Misconfigured Pod Security Policies
- Scans for wide range of Misconfigured Network policies
- Scans the privileges of a subject in the cluster
- Run commands on the containers and streams back the output
- Provides the endpoints of the misconfigured services
- Provides possible privilege escalation details
- Elaborative report with detailed explanation

## Future improvements

- Automated exploitation based on the issues identified
- api and cicd automation friendly
- A Decent FrontEnd to make the lives easier

## GitHub:

> **[GitHub - vchinnipilli/kubestriker: A Blazing fast Security Auditing tool for...](https://github.com/vchinnipilli/kubestriker)**
>
> A Blazing fast Security Auditing tool for Kubernetes