SuperAPI AI Directory
Partner中文AI newsFavorites
Skillscloud-k8s

cloud-k8s

Data & analytics

View repository

Updated 10-16 09:58

About this skill

⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.

Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

  1. Ask the user to state the exact target URL, IP, account, or resource.
  2. Ask the user to confirm written authorization and the permitted scope.
  3. Show the exact command(s) and explain their expected effect.
  4. Wait for explicit confirmation in the current conversation.

Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

Cloud / Container / Kubernetes Security

When to Use

  • Assessing cloud workload or Kubernetes cluster security within an approved scope.
  • Reviewing IAM/RBAC configurations for privilege-escalation paths.

Applicable Scenarios

  • Cloud metadata SSRF (169.254.169.254 / IMDS)
  • IAM excessive permissions, public storage buckets, misconfigured security groups
  • Docker/containerd escape path assessment
  • Kubernetes RBAC, Secrets, Admission, supply chain images
  • Container image vulnerabilities (can be linked with supply-chain-security/）

Workflow

Phase 1 — Identity and Boundary

□ 当前身份：云 AK/SK、K8s SA、节点 SSH？
□ 范围：单账号 / 单 cluster / 单 namespace
□ 网络档：authorized_target_only

Phase 2 — Cloud Control Plane

# 示例（按厂商替换；MUST 在授权账号内）
aws sts get-caller-identity
aws s3 ls
# Azure / GCP 对应 identity 命令

□ 公开桶 / 错误 ACL
□ 元数据：IMDSv1 vs v2；SSRF 链
□ 角色可扮演（PassRole）与横向

Phase 3 — Containers

□ 是否 privileged / hostPath / hostNetwork
□ capabilities（SYS_ADMIN 等）
□ 可写宿主机路径 → 逃逸候选
□ 镜像历史与已知 CVE → Trivy

Phase 4 — Kubernetes

kubectl auth can-i --list
kubectl get pods,secrets,svc -A
kubectl get clusterrolebindings

□ SA token 挂载与权限
□ 危险 admission webhook 缺失
□ etcd / dashboard 暴露
□ 网络策略是否默认放行

Toolchain

Tool Purpose Bootstrap
kubectl Cluster interaction Manual
trivy Image/IaC bootstrap trivy if available
kube-bench / kubeaudit CIS/Configuration Manual
pacu / scoutsuite Cloud audit (authorized) Manual
nuclei Known cloud vulnerability templates bootstrap nmap/nuclei ecosystem

Reference

  • references/k8s-cloud-checklist.md
  • CTF comparison:../../CTF-Sandbox-Orchestrator/competition-agent-cloud/
  • ../supply-chain-security/ ../pentest-tools/

Routing context

Upstream: MASTER R23
Downstream: obtain node shell → attack-chain / windows-ad; image vulnerabilities → supply-chain
MUST NOT: unauthorized scanning of other tenants on public clouds

Task Completion Self-Check

  • Is it limited to the authorized account/cluster?
  • Do findings include reproduction and impact?
  • Are destructive operations avoided?
  • Report / journal?

Limitations

  • Cloud provider API calls may incur cost and trigger alerts; coordinate with the owner.
  • Escape-path validation must stay inside disposable lab clusters.

Adapted from zhaoxuya520/reverse-skill (MIT).