Meta tags:
description=;

Headings (most frequently used words):

the, kubenomicon, what, is, threat, matrix, prior, work,

Text of the page (most frequently used words):
container (18), access (16), the (15), kubernetes (12), from (10), #kubenomicon (9), this (8), credentials (8), service (8), application (8), and (7), server (6), hostpath (6), mount (6), api (6), account (6), cloud (6), threat (5), matrix (5), files (5), resources (5), cluster (5), was (4), poisoning (4), malicious (4), admission (4), controller (4), inside (4), writable (4), exposed (4), sensitive (4), interfaces (4), configuration (4), pod (4), data (4), registry (4), offensive (4), information (3), great (3), project (3), microsoft (3), exploit (3), kubelet (3), new (3), secrets (3), attack (3), document (2), many (2), projects (2), that (2), what (2), inspired (2), some (2), for (2), arp (2), spoofing (2), coredns (2), static (2), pods (2), ssh (2), running (2), instance (2), metadata (2), managed (2), identity (2), connect (2), proxy (2), sidecar (2), injection (2), vulnerability (2), denial (2), internal (2), networking (2), network (2), mapping (2), name (2), similarity (2), cronjob (2), rce (2), kubeconfig (2), file (2), resource (2), hijacking (2), collecting (2), node (2), delete (2), events (2), admin (2), binding (2), compromised (2), image (2), destruction (2), images (2), private (2), list (2), k8s (2), clear (2), logs (2), privileged (2), backdoor (2), exec (2), using (2), impact (2), collection (2), lateral (2), movement (2), discovery (2), credential (2), defense (2), evasion (2), privilege (2), escalation (2), persistence (2), execution (2), initial (2), framework (2), understand (2), security (2), home (2), hacktricks, far, first, person, come, with, idea, exist, take, similar, approach, most, notably, additionally, late, into, putting, together, discovered, amazing, other, served, inspiration, include, redguard, prior, work, heavily, which, starting, point, provides, help, concepts, style, explicitly, not, designed, playbook, professionals, thus, lacks, details, necessary, actually, remediate, each, mitre, things, world, there, are, constantly, surfaces, explore, solution, start, place, where, techniques, how, defend, against, them, can, easily, documented, via, pull, requests, github, move, really, fast, will, never, able, solely, every, defensive, technique, own, born, desire, more, about, perspective, found, aid, journey, but, quickly, realized, ayu, navy, coal, rust, light, default, pentesting, contributing, interesting, namespaces, rbac, etcd, services, nodes, fundamentals,

Text of the page (random words):
home kubenomicon the kubenomicon home kubenomicon 1 initial access 1 1 using cloud credentials 1 2 compromised image in registry 1 3 kubeconfig file 1 4 application vulnerability 1 5 exposed sensitive interfaces 1 6 ssh server running inside container 2 execution 2 1 exec inside container 2 2 new container 2 3 application exploit rce 2 4 sidecar injection 3 persistence 3 1 backdoor container 3 2 writable hostpath mount 3 3 kubernetes cronjob 3 4 malicious admission controller 3 5 container service account 3 6 static pods 4 privilege escalation 4 1 privileged container 4 2 cluster admin binding 4 3 hostpath mount 4 4 access cloud resources 5 defense evasion 5 1 clear container logs 5 2 delete events 5 3 pod name similarity 5 4 connect from proxy server 6 credential access 6 1 list k8s secrets 6 2 access node information 6 3 container service account 6 4 application credentials in configuration files 6 5 access managed identity credentials 6 6 malicious admission controller 7 discovery 7 1 access kubernetes api server 7 2 access kubelet api 7 3 network mapping 7 4 exposed sensitive interfaces 7 5 instance metadata api 8 lateral movement 8 1 access cloud resources 8 2 container service account 8 3 cluster internal networking 8 4 application credentials in configuration files 8 5 writable hostpath mount 8 6 coredns poisoning 8 7 arp poisoning and ip spoofing 9 collection 9 1 images from a private registry 9 2 collecting data from pod 10 impact 10 1 data destruction 10 2 resource hijacking 10 3 denial of service 11 fundamentals 11 1 nodes 11 2 services 11 3 etcd 11 4 rbac 11 5 kubelet 11 6 namespaces 11 7 secrets 11 8 interesting files contributing pentesting kubernetes light default rust coal navy ayu the kubenomicon what is the kubenomicon the kubenomicon was born of a desire to understand more about kubernetes from an offensive perspective i found many great resources to aid in my journey but i quickly realized i will never be able to solely document every offensive and defensive kubernetes technique on my own things in the kubernetes world move really fast and there are constantly new attack surfaces to explore my solution to this is to start the kubenomicon a place where offensive security techniques and how to defend against them can easily be documented via pull requests to the kubenomicon github this project was heavily inspired by the kubernetes threat matrix from microsoft which is a great starting point as it provides a framework to help understand some of the concepts in a mitre attack style framework the microsoft threat matrix was explicitly not designed to be a playbook offensive for security professionals and thus it lacks the details necessary to actually exploit and remediate each attack in kubernetes cluster the kubenomicon threat matrix initial access execution persistence privilege escalation defense evasion credential access discovery lateral movement collection impact using cloud credentials exec inside container backdoor container privileged container clear container logs list k8s secrets access kubernetes api server access cloud resources images from a private registry data destruction compromised image in registry new container writable hostpath mount cluster admin binding delete events access node information access kubelet api container service account collecting data from pod resource hijacking kubeconfig file application exploit rce kubernetes cronjob hostpath mount pod name similarity container service account network mapping cluster internal networking denial of service application vulnerability sidecar injection malicious admission controller access cloud resources connect from proxy server application credentials in configuration files exposed sensitive interfaces application credentials in configuration files exposed sensitive interfaces container service account access managed identity credentials instance metadata api writable hostpath mount ssh server running inside container static pods malicious admission controller coredns poisoning arp poisoning and ip spoofing prior work i am far from the first person to come up with the idea to document this information many great projects exist that take a similar approach to this most notably what inspired this project was the microsoft kubernetes threat matrix additionally late into putting this project together i discovered this amazing threat matrix from redguard some other projects that served as inspiration for this include kubernetes hacktricks