Purpose
Use this skill for Kubernetes exposure review when the engagement needs to understand whether a cluster exposes risky services or endpoints.
Phase Fit
- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Retest and Closure
Use When
- Need to assess remotely reachable Kubernetes exposure.
- Need to review cluster attack surface in a structured way.
- Need a repeatable retest after exposure reduction.
Avoid When
- The cluster is out of scope.
- In-cluster or active modes are not explicitly approved.
Inputs
- Approved cluster endpoint or IP
- Allowed mode, preferably remote and low impact
- Output handling requirements
Procedure
- Start with remote or low-impact assessment modes.
- Review only findings that materially expand attack surface.
- Manually confirm important issues before escalation.
- Correlate findings with cluster role and business context.
- Preserve the exact mode and target for retest.
Command Syntax
Replace sample targets with approved in-scope values.
# Passive scan against a remote API server
kube-hunter --remote 10.10.10.100
# Scan a CIDR range for Kubernetes components
kube-hunter --cidr 10.10.10.0/24
# Output to JSON
kube-hunter --remote 10.10.10.100 --report json > contoso-kube-hunter.json
# Active hunting (may create containers — requires explicit approval)
kube-hunter --active --remote 10.10.10.100
# Hunt from inside a running pod
kube-hunter --pod
Evidence to Capture
- Remotely reachable Kubernetes exposure
- Exact cluster endpoint and mode used
- Findings that materially change cluster risk
Safety Boundaries
- Prefer remote, low-impact assessment modes.
- Use more invasive modes only with explicit written approval.