aquasecurity/kube-hunter
Kube Hunter
Kube-hunter is a security scanner and vulnerability hunter for Kubernetes clusters. It operates as a cloud-native penetration tool designed to identify security weaknesses, infrastructure misconfigurations, and exploitable gaps by simulating attacker techniques.
The tool distinguishes itself through a dual-mode scanning engine that executes both remote external probes and internal network scans. It features identity-based impersonation, allowing it to use service account tokens and pod identities to simulate security access from specific cluster roles and determine the potential blast radius of a container compromise.
The project covers a broad surface of security assessment capabilities, including cluster vulnerability scanning, internal network topology mapping, and compliance verification. It can detect exposed secrets, analyze infrastructure templates for misconfigurations, and perform active exploitation attempts to verify that discovered vulnerabilities are leverageable.
The application is packaged as a standalone executable to remove runtime dependencies during deployment.
Features
- Kubernetes Vulnerability Hunters - Provides an active probing tool to identify exploitable gaps in Kubernetes nodes and service account permissions.
- Penetration Testing Frameworks - Simulates attacker techniques and pod compromises to identify lateral movement paths and exploitability.
- Live Cluster Security Scanners - Inspects running Kubernetes clusters to identify security weaknesses and best practice violations.
- Internal Network Penetration Testers - Analyzes network interfaces from within the environment to identify internal exposure and lateral movement paths.
- Cloud Native Penetration Testing - Provides a specialized utility for simulating pod compromises and mapping internal network topology in Kubernetes.
- Exploitability Verification - Verifies if discovered vulnerabilities are actually leverageable by performing active exploitation attempts.
- Internal Network Discoverers - Maps the network topology of a cluster to identify internal services and unauthorized exposure.
- Automated Node Discovery - Provides automated discovery of cluster nodes via system APIs to target them for security scanning.
- Compromise Simulations - Simulates pod compromises as a local unit to determine the potential blast radius and accessible resources.
- Infrastructure Security Scanners - Analyzes cluster state and infrastructure templates to detect security gaps and non-compliant settings.
- Kubernetes Cluster Assessments - Probes cluster nodes and APIs to discover exposed secrets and infrastructure gaps to harden the environment.
- Network Vulnerability Scanning - Probes external IPs or domains from an outside machine to simulate the perspective of an external attacker.
- Account Impersonation - Simulates security access by assuming the identity of specific Kubernetes service accounts and pod roles.
- Kubernetes Security Assessments - Scans Kubernetes clusters to identify security weaknesses and misconfigurations that could be exploited.
- Vulnerability Scanning - Scans clusters to identify security weaknesses and infrastructure misconfigurations to help harden the environment.
- Active Scanning Engines - Implements an active scanning engine that executes both remote probes and internal network scans to identify vulnerabilities.
- Network Topology Mapping - Generates maps of discovered nodes within specified network ranges to visualize cluster topology.
- Kubernetes Compliance Monitoring - Analyzes infrastructure templates and cluster states to verify compliance with security standards and policies.
- Misconfiguration Scanning - Analyzes infrastructure templates and cluster states against security benchmarks to find non-compliant configurations.
- Secret Scanning - Scans files and images for sensitive information such as passwords or keys accidentally committed to source control.
- Security Finding Dispatchers - Routes discovered security vulnerabilities through a filtering pipeline to standard output or remote analysis endpoints.
- Security Module Integrations - Allows the integration of custom modules that subscribe to cluster events to trigger new security checks.
- Modular Plugin Frameworks - Provides a plugin-based framework where modular hunter classes subscribe to discovery events to perform security checks.
- Cloud Native Security - Hunts for security weaknesses in Kubernetes clusters.
- Attacking - Listed in the “Attacking” section of the Awesome K8s Security awesome list.
- Application Security - Hunts for security weaknesses in Kubernetes clusters.
- Cloud Security - Scans Kubernetes clusters for security weaknesses.
- Hunting Tools - Tool for hunting security weaknesses in Kubernetes clusters.
- Kubernetes Security - Active security scanner for Kubernetes clusters.
- Security and Compliance - Scans clusters for potential security weaknesses.
- Vulnerability Scanning - Hunts for security weaknesses within cluster environments.
