Kube-hunter ist ein Sicherheitsscanner und Schwachstellen-Jäger für Kubernetes-Cluster. Es arbeitet als Cloud-natives Penetrationstool, das entwickelt wurde, um Sicherheitsschwachstellen, Fehlkonfigurationen der Infrastruktur und ausnutzbare Lücken durch die Simulation von Angreifertechniken zu identifizieren.
Die Hauptfunktionen von aquasecurity/kube-hunter sind: Kubernetes Vulnerability Hunters, Penetration Testing Frameworks, Live Cluster Security Scanners, Internal Network Penetration Testers, Cloud Native Penetration Testing, Exploitability Verification, Internal Network Discoverers, Automated Node Discovery.
Open-Source-Alternativen zu aquasecurity/kube-hunter sind unter anderem: armosec/kubescape — Kubescape is a security platform for Kubernetes that provides tools for scanning clusters, configurations, and… aquasecurity/kube-bench — kube-bench is a Kubernetes security benchmark scanner and configuration auditor. It verifies if a cluster adheres to… deepfence/threatmapper — ThreatMapper is a cloud native application protection platform and infrastructure security scanner. It functions as a… projectdiscovery/naabu — Naabu is a port scanner library and tool that probes hosts for open ports using SYN, CONNECT, and UDP methods to… snyk/cli — The Snyk CLI is a command-line security scanner that detects known vulnerabilities across open-source dependencies,… aquasecurity/trivy — Trivy is a comprehensive security scanner designed to identify vulnerabilities and misconfigurations across container…
Kubescape is a security platform for Kubernetes that provides tools for scanning clusters, configurations, and container images against industry compliance and security benchmarks. It functions as a suite of security utilities, including a compliance auditor, a misconfiguration scanner, and a container vulnerability scanner. The project differentiates itself through automated remediation and active enforcement. It can automatically patch operating system vulnerabilities in images and fix security errors within manifest files. It also utilizes an admission controller to block the deployment of
kube-bench is a Kubernetes security benchmark scanner and configuration auditor. It verifies if a cluster adheres to the Center for Internet Security standards and other hardening guides to identify security misconfigurations and vulnerabilities. The tool operates as a containerized security scanner, utilizing host namespaces to analyze nodes and control plane components without requiring the installation of binaries directly on the host. It supports multiple Kubernetes distributions, applying environment-specific benchmarks to ensure auditing accuracy for managed services. The project cover
ThreatMapper is a cloud native application protection platform and infrastructure security scanner. It functions as a vulnerability management system and cloud workload telemetry collector designed to monitor workloads and detect security risks across cloud and container environments. The platform distinguishes itself through a network traffic visualizer that uses machine learning to classify communication patterns and a graph-based attack mapping system to identify high-risk paths between vulnerabilities and network dependencies. Its broader capabilities cover cloud infrastructure complianc
Naabu is a port scanner library and tool that probes hosts for open ports using SYN, CONNECT, and UDP methods to identify active services. It functions as a Go library for embedding port scanning into programs, and as a standalone tool that accepts targets as hostnames, IP addresses, CIDR ranges, or ASN numbers. The tool discovers live hosts before scanning, filters ports by range or top lists, and can integrate with Nmap for service version detection. The project distinguishes itself through its SYN-based port probing approach that sends TCP SYN packets and analyzes responses without complet