Overview

pentest-container-k8s evaluates Docker and Kubernetes security controls to uncover RBAC abuse vectors, container breakout risks, and secret exposure. It maps container and cluster misconfigurations to exploit relevance and produces reproducible findings for remediation.

How This Skill Works

The skill runs a Python tool (container_k8s.py) that validates the test scope, executes only authorized checks aligned to PTES, OWASP WSTG, NIST SP 800-115, and MITRE ATT&CK, and outputs findings and PoCs in a canonical format. It supports a dry-run mode and requires explicit --i-have-authorization for live tests, exporting artifacts like container-findings.json, k8s-rbac-risks.json, and k8s-report.json.

When to Use It

• During a containerized app security assessment to verify RBAC and secret exposure controls
• When validating Kubernetes RBAC configurations and service accounts before production deployment
• In red-team/blue-team exercises with authorized targets focusing on privilege escalation paths
• For environments with sensitive data in containers that may be exposed via secrets
• To map misconfigurations against MITRE ATT&CK techniques such as T1610, T1611

Quick Start

1. Step 1: Prepare scope.json and target details
2. Step 2: Run the tool: python skills/pentest-container-k8s/scripts/container_k8s.py --scope scope.json --target <target> --input <path> --output <path> --format json --dry-run
3. Step 3: Review container-findings.json, k8s-rbac-risks.json, and k8s-report.json and plan remediations

Best Practices

• Obtain written authorization and clearly scope the targets before testing
• Run in dry-run mode first to avoid live impact
• Capture reproducible PoC notes and map findings to the canonical finding_schema
• Export deterministic artifacts (container-findings.json, k8s-rbac-risks.json, k8s-report.json) for downstream use
• Review results against PTES, OWASP WSTG, NIST SP 800-115, and MITRE ATT&CK mappings

Example Use Cases

• An RBAC misconfiguration allowed a non-admin service account to create cluster roles, enabling privilege escalation
• Secrets mounted in environment variables or config maps were exposed in pod specs or logs
• A privileged pod with hostPath access enabled container breakout from the pod into the host
• Kubernetes token exposure through insecure API access or leaked service account tokens
• Misconfigured imagePullSecrets or secret management led to sensitive data leakage on nodes

Frequently Asked Questions