Kubernetes-Goat – Is A “Vulnerable By Design” Kubernetes Cluster. Designed To Be An Intentionally Vulnerable Cluster Environment To Learn And Practice Kubernetes Security

The Kubernetes Goat is designed to be an intentionally vulnerable cluster environment to learn and practice Kubernetes security.

Refer to https://madhuakula.com/kubernetes-goat for the guide.

Show us some

Please feel free to send us a PR and show some

DEFCON DEMO Labs

Cloud Village – DEFCON

Recent Kubernetes Goat Presentations

OWASP Bay Area Meetup

[embedded content]

DEFCON Red Team Village

[embedded content]

https://katacoda.com/madhuakula/scenarios/kubernetes-goat

• Before we set up the Kubernetes Goat, ensure that you have created and have admin access to the Kubernetes cluster

kubectl version --short

• Set up the helm version 2 in your path as helm2. Refer to helm releases for more information about setup

helm2 --help

• Then finally setup Kubernetes Goat by running the following command

git clone https://github.com/madhuakula/kubernetes-goat.git
cd kubernetes-goat
bash setup-kubernetes-goat.sh

• To export the ports/services locally to start learning, run the following command

bash access-kubernetes-goat.sh

Kubernetes Goat – KIND setup

• If you want to setup Kubernetes Goat using KIND, refer to kind-setup

1. Sensitive keys in code-bases
2. DIND (docker-in-docker) exploitation
3. SSRF in K8S world
4. Container escape to access host system
5. Docker CIS Benchmarks analysis
6. Kubernetes CIS Benchmarks analysis
7. Attacking private registry
8. NodePort exposed services
9. Helm v2 tiller to PwN the cluster
10. Analysing crypto miner container
11. Kubernetes Namespaces bypass
12. Gaining environment information
13. DoS the memory/CPU resources
14. Hacker Container preview
15. Hidden in layers
16. RBAC Least Privileges Misconfiguration
17. KubeAudit – Audit Kubernetes Clusters
18. Sysdig Falco – Runtime Security Monitoring & Detection
19. Popeye – A Kubernetes Cluster Sanitizer
20. Secure network boundaries using NSP

Kubernetes Goat creates intentionally vulnerable resources into your cluster. DO NOT deploy Kubernetes Goat in a production environment or alongside any sensitive cluster resources.

Kubernetes Goat comes with absolutely no warranties whatsoever. By using Kubernetes Goat, you take full responsibility for all outcomes that result.

Source : KitPloit – PenTest Tools!