mcpField
C
cloud-k8s

cloud-k8s

github.com/zhaoxuya520Security43.7k1.1k installsUpdated 5w ago
Repository

About cloud-k8s

A skill for cloud, container, and Kubernetes security assessments, organized around identity and exposure, cloud control planes, containers, and cluster configuration. It requires defined authorization and scope, and cautions against destructive actions or unauthorized public-cloud scanning.

Key features

  1. 01Review cloud identities, permissions, and exposed resources
  2. 02Assess IMDS and SSRF risks
  3. 03Check container privileges, mounts, and image vulnerabilities
  4. 04Review Kubernetes RBAC, Secrets, and network policies
  5. 05Limit scope to authorized accounts, clusters, and namespaces

Use cases

  1. 01Audit cloud IAM, public buckets, and security groups
  2. 02Assess Kubernetes permissions and cluster configuration
  3. 03Check container escape paths and image CVEs

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/zhaoxuya520/reverse-skill --skill cloud-k8s

After installing, type/cloud-k8sin Claude Code to confirm it loaded.

Bundled filesreferences/k8s-cloud-checklist.md

Details

From the project README

Cloud / Container / Kubernetes Security

ACTION REQUIRED（读完后立刻执行）

  1. NOW: 读取 ../field-journal/precedent-pentest.md — 云/K8s 测试必须书面授权
  2. NOW: case-init + scope；明确账号边界、禁止破坏性操作
  3. NOW: 确认是云元数据/容器/K8s/IAM，而非普通 Web 扫（后者 pentest-tools/）
  4. NEXT: tool-index；kubectl/aws/gcloud 等多为手动安装
  5. ACT: 从「身份与暴露面」开始，禁止默认全网扫描

适用场景

  • 云元数据 SSRF（169.254.169.254 / IMDS）
  • IAM 过度权限、公开存储桶、错误安全组
  • Docker/containerd 逃逸路径评估
  • Kubernetes RBAC、Secrets、Admission、供应链镜像
  • 容器镜像漏洞（可联动 supply-chain-security/）

工作流

Phase 1 — 身份与边界
□ 当前身份：云 AK/SK、K8s SA、节点 SSH？
□ 范围：单账号 / 单 cluster / 单 namespace
□ 网络档：authorized_target_only
Phase 2 — 云控制面
# 示例（按厂商替换；MUST 在授权账号内）
aws sts get-caller-identity
aws s3 ls
# Azure / GCP 对应 identity 命令

□ 公开桶 / 错误 ACL
□ 元数据：IMDSv1 vs v2；SSRF 链
□ 角色可扮演（PassRole）与横向
Phase 3 — 容器
□ 是否 privileged / hostPath / hostNetwork
□ capabilities（SYS_ADMIN 等）
□ 可写宿主机路径 → 逃逸候选
□ 镜像历史与已知 CVE → Trivy
Phase 4 — Kubernetes
kubectl auth can-i --list
kubectl get pods,secrets,svc -A
kubectl get clusterrolebindings

□ SA token 挂载与权限
□ 危险 admission webhook 缺失
□ etcd / dashboard 暴露
□ 网络策略是否默认放行

工具链

工具用途自举
kubectl集群交互手动
trivy镜像/IaCbootstrap trivy 若可用
kube-bench / kubeauditCIS/配置手动
pacu / scoutsuite云审计（授权）手动
nuclei已知云漏洞模板bootstrap nmap/nuclei 生态

参考

  • references/k8s-cloud-checklist.md
  • CTF 对照：../../CTF-Sandbox-Orchestrator/competition-agent-cloud/
  • ../supply-chain-security/ ../pentest-tools/

路由上下文

上游: MASTER R23
下游: 拿到节点 shell → attack-chain / windows-ad；镜像漏洞 → supply-chain
MUST NOT: 未授权扫公有云其他租户

任务完成自检

  • 是否限定在授权账号/cluster？
  • 发现是否含复现与影响？
  • 是否避免破坏性操作？
  • 报告 / journal？

Comments

Markdown supported