SuperAPI AI Directory
Partner中文AI newsFavorites
Skillsk8s-network-recon

k8s-network-recon

General & other

View repository

Updated 10-16 07:23

About this skill

→ Read references/network-attacks.md

Network reconnaissance within a Kubernetes cluster

The first step in lateral movement within a K8s cluster is figuring out what other services are running. Because K8s uses DNS for service discovery, every Service and Pod has a predictable DNS name, which means the entire cluster can be systematically enumerated through DNS reverse lookup.

K8s DNS naming rules

Resource type DNS format Example
Service <svc>.<ns>.svc.cluster.local redis.default.svc.cluster.local
Pod <pod-ip-dashed>.<ns>.pod.cluster.local 10-244-0-5.default.pod.cluster.local
Headless Service <pod-name>.<svc>.<ns>.svc.cluster.local web-0.nginx.default.svc.cluster.local

Note: The DNS suffix is not necessarily cluster.local, it is determined by the cluster configuration. Check the /etc/resolv.conf line in search .

SRV records

A Service's SRV records expose port information:

nslookup -type=srv <service>.<namespace>.svc.cluster.local
# 输出示例: service = 0 50 80 svc.ns.svc.cluster.local
# 即使没有 _proto 前缀，也能查到所有有效端口

Phase 1: Determine the scan scope

DNS PTR reverse lookup is per-IP—a /16 range has 65535 IPs, and a blind scan may take tens of minutes. Spending 30 seconds first to determine the Service CIDR can reduce scan time from minutes to seconds.

First obtain entry point information (ordered from highest to lowest reliability)

# 1. 环境变量（最快，几乎必有）
echo $KUBERNETES_SERVICE_HOST
env | grep -i service_host

# 2. DNS 配置（nameserver 地址通常在 Service CIDR 内）
cat /etc/resolv.conf

# 3. DNS 查询（返回的 API Server IP 暴露 CIDR 段）
nslookup kubernetes.default.svc.cluster.local

# 4. 路由表/ARP（辅助推断）
cat /etc/hosts && ip route && arp -a 2>/dev/null

# 5. 避免用 ip addr — sidecar 注入的虚拟网卡会干扰判断

Infer the Service CIDR from the obtained IP.

Subnet range selection strategy

⚠️ Do not use /8 or larger ranges — 16M+ IPs can never be fully scanned and will waste an entire round of time.

Recommended scan granularity:

  1. First use the KUBERNETES_SERVICE_HOST obtained above to determine the Service CIDR
  2. Start from /24 (256 IPs, completes in seconds); if there are no results, expand to /16(65K IPs, minutes)
  3. Common Service CIDRs:10.96.0.0/16、10.100.0.0/16、10.43.0.0/16（K3s）
  4. If KUBERNETES_SERVICE_HOST is 10.96.0.1, scan 10.96.0.0/16

Phase 2: DNS batch scanning

Use K8Spider (recommended)

# PTR 反查 + SRV 记录 + 多线程，一条命令完成全部扫描
k8spider scan -subnet 10.100.0.0/24

# 更大的范围
k8spider scan -subnet 10.96.0.0/12    # 默认 Service CIDR
k8spider scan -subnet 10.244.0.0/16   # Pod CIDR (Flannel 默认)
k8spider scan -subnet 10.42.0.0/16    # Pod CIDR (K3s 默认)

Alternative: Some CTF environments have preinstalled dnscan(usage: dnscan -subnet <cidr>), with similar functionality but no support for SRV record enumeration. Prefer K8Spider.

Manual method when no tools are available

# PTR 反查 (逐个 IP)
for i in $(seq 1 254); do
  nslookup 10.100.0.$i 2>/dev/null | grep -v "NXDOMAIN" | grep "name =" &
done; wait

# AXFR 域传输（如果 CoreDNS 允许）
dig axfr cluster.local @$(grep nameserver /etc/resolv.conf | awk '{print $2}')

# Wildcard DNS（已被新版 CoreDNS 废弃，但老版本可能有效）
nslookup any.any.svc.cluster.local

Phase 3: Service exploitation

After discovering services, prioritize them by attack value:

  1. Direct flag/data services(names containing flag, secret, internal) → immediately access with curl
  2. Cluster control plane(API Server 6443, etcd 2379, kubelet 10250) → unauthorized access = cluster takeover
  3. Policy/Webhook services(kyverno-svc, gatekeeper) → can extract injected Secrets
  4. Monitoring/operations(prometheus 9090, grafana 3000, dashboard 8443) → information leakage + credentials
  5. Business services(other custom services) → judge based on name and port
# 访问发现的服务
curl <service>.<namespace>.svc.cluster.local
curl <service>.<namespace>.svc.cluster.local:<port>

# 对高价值目标尝试多个路径
curl -s http://<svc>:<port>/
curl -s http://<svc>:<port>/flag
curl -s http://<svc>:<port>/api/v1
curl -sk https://<svc>:<port>/

Related skills

After discovering services, load the corresponding skill based on the target type:

  • Istio/Envoy-related services → Skill(skill="k8s-istio-bypass")
  • Kyverno/OPA Webhook → Skill(skill="k8s-webhook-abuse")
  • NFS/EFS storage → Skill(skill="k8s-storage-exploit")
  • API Server/Kubelet → Skill(skill="k8s-container-escape")
  • Detailed K8Spider tool usage → Skill(skill="k8spider")

Tool quick reference

Tool Purpose Installation
K8Spider K8s DNS batch scanning (PTR+SRV+AXFR+multithreaded) go install github.com/Esonhugh/k8spider@latest
nslookup/dig Manual DNS query Built into the system
CDK Container penetration toolkit (including service discovery) Download it yourself from the project Release; in an intranet environment it can also be installed via the f8x CLI (internal tool, not included in this repository)