Kubnerable
Kubnerable is an out-cluster vulnerability scanner tool for Kubernetes resources. It comes with a predefined vulnerability database (vulnerabilities.yaml) with basic pod weaknesses checks.
For testing purposes, there is a Kind setup for bootstrapping a cluster with vulnerable predefined scenarios. For more info, check the following README.
This project was done as part of my Master's Thesis and as an excuse to learn Go from scratch
Features
- Out-cluster resource vulnerabilities scanning
- Needs a valid Kubeconfig file with read access
- Correlates vulnerabilities with risk and CVSS score
- Allows custom vulnerabilities or checks
Usage
❯ ./kubnerable -h
Kubnerable scans all pods and containers of a Kubernetes cluster in search of exploitable vulnerabilities
Usage:
kubnerable [flags]
Examples:
kubnerable -f ../vulnerabilities.yaml
Flags:
-h, --help help for kubnerable
-f, --vuls-file string Vulnerabilities YAML file path, needed for scanning (default "../vulnerabilities.yaml")
TODOs
- Resource denial of services and the associated scenario
- Network exposure and the associted scenario
- RBAC analysis
Inspirations
Kubnerable is inspired by today's state-of-the-art Kubernetes vulnerability scanners:
- Kubernetes vulnerability mapping inspired by Octarine's KCCSS
- YAML Vulnerability Database inspired by Aqua Security's Kube-Bench
