The Hacker's Guide to Kubernetes
summary
Live demos chain small misconfigurations into full account takeover: attackers scan with nmap and curl, find an open kubelet API, use kubelet exec to get a reverse shell, install tcpdump, and capture JWT bearer tokens. Calico’s default CNI allows pod-to-pod access so an exploited demo app reaches Redis on 6379 exposed and replays sessions. A privileged pod with writable container filesystem and hostPID escapes to the node, reads an etcd snapshot, and stole JWT signing key from etcd snapshot to mint valid tokens. Tools shown: tcpdump, nc, redis-cli, curl.
AI-written summary · about
chapters (8)
- 0:00Introduction to Kubernetes hacking
- 2:58Kubernetes architecture overview
- 8:54Kubernetes top 10 security risks
- 12:39Demo 1: Exploiting open CUE API
- 29:59Demo 2: Remote code execution in cluster
- 38:51Demo 3: Privilege escalation to node
- 47:29Security model and best practices
- 50:04Q&A session
related talks
50mThe Hacker’s Guide to Kubernetes Reloaded
45mThe Hacker’s Guide to Kubernetes
46mThe Hacker's Guide to Kubernetes
51mThe Hacker’s Guide to Insecure Workload Configuration in Kubernetes
54mThe Hacker’s Guide to Kubernetes
50mBeyond the Pod: Privilege Escalation in Kubernetes
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
40mHacking and Hardening Kubernetes Clusters by Example [I]