Merges #225 (#278)

* Fix typos

* Fix review comments

docs/_kb/KHV037.md

@@ -8,7 +8,7 @@ categories: [Information Disclosure]
 
 ## Issue description
 
-The kubelet is is leaking container logs via the `/containerLogs` endpoint. This endpoint is exposed as part of the kubelet's debug handlers.
+The kubelet is leaking container logs via the `/containerLogs` endpoint. This endpoint is exposed as part of the kubelet's debug handlers.
 
 
 ## Remediation

docs/_kb/KHV038.md

@@ -8,7 +8,7 @@ categories: [Information Disclosure]
 
 ## Issue description
 
-The kubelet is is leaking information about runnig pods via the `/runningpods` endpoint. This endpoint is exposed as part of the kubelet's debug handlers.
+The kubelet is leaking information about running pods via the `/runningpods` endpoint. This endpoint is exposed as part of the kubelet's debug handlers.
 
 
 ## Remediation

docs/_kb/KHV039.md

@@ -8,7 +8,7 @@ categories: [Remote Code Execution]
 
 ## Issue description
 
-An attacker could run arbitrary commands on a container via the the kubelet's `/exec` endpoint. This endpoint is exposed as part of the kubelet's debug handlers.
+An attacker could run arbitrary commands on a container via the kubelet's `/exec` endpoint. This endpoint is exposed as part of the kubelet's debug handlers.
 
 ## Remediation
 

docs/_kb/KHV040.md

@@ -8,7 +8,7 @@ categories: [Remote Code Execution]
 
 ## Issue description
 
-An attacker could run arbitrary commands on a container via the the kubelet's `/run` endpoint. This endpoint is exposed as part of the kubelet's debug handlers.
+An attacker could run arbitrary commands on a container via the kubelet's `/run` endpoint. This endpoint is exposed as part of the kubelet's debug handlers.
 
 ## Remediation
 

docs/_kb/KHV041.md

@@ -8,7 +8,7 @@ categories: [Remote Code Execution]
 
 ## Issue description
 
-An attacker could read and write data from a pod via the the kubelet's `/portForward` endpoint. This endpoint is exposed as part of the kubelet's debug handlers.
+An attacker could read and write data from a pod via the kubelet's `/portForward` endpoint. This endpoint is exposed as part of the kubelet's debug handlers.
 
 ## Remediation
 

docs/_kb/KHV042.md

@@ -8,7 +8,7 @@ categories: [Remote Code Execution]
 
 ## Issue description
 
-An attacker could attach to a running container via a websocket on the the the kubelet's `/attach` endpoint. This endpoint is exposed as part of the kubelet's debug handlers.
+An attacker could attach to a running container via a websocket on the kubelet's `/attach` endpoint. This endpoint is exposed as part of the kubelet's debug handlers.
 
 ## Remediation
 

docs/_kb/KHV043.md

@@ -8,7 +8,7 @@ categories: [Information Disclosure]
 
 ## Issue description
 
-The kubelet is is leaking it's health information, which may contain sensitive information, via the `/healthz` endpoint. This endpoint is exposed as part of the kubelet's debug handlers.
+The kubelet is leaking it's health information, which may contain sensitive information, via the `/healthz` endpoint. This endpoint is exposed as part of the kubelet's debug handlers.
 
 ## Remediation
 

docs/_kb/KHV045.md

@@ -8,7 +8,7 @@ categories: [Information Disclosure]
 
 ## Issue description
 
-The kubelet is is leaking system logs via the `/logs` endpoint. This endpoint is exposed as part of the kubelet's debug handlers.
+The kubelet is leaking system logs via the `/logs` endpoint. This endpoint is exposed as part of the kubelet's debug handlers.
 
 ## Remediation
 

docs/_kb/KHV049.md

@@ -8,7 +8,7 @@ categories: [Information Disclosure]
 
 ## Issue description
 
-An open kubectl proxy was detected. `kubectl proxy` is a convenient tool to connent from a local machine into an application running in Kubernetes or to the Kubernetes API. This is common practice to browse for example the Kubernetes dashboard. Leaving an open proxy can be exploited by an attacker to gain access into your entire cluster.
+An open kubectl proxy was detected. `kubectl proxy` is a convenient tool to connect from a local machine into an application running in Kubernetes or to the Kubernetes API. This is common practice to browse for example the Kubernetes dashboard. Leaving an open proxy can be exploited by an attacker to gain access into your entire cluster.
 
 ## Remediation
 

plugins/logging_mod.py

@@ -1,5 +1,5 @@
 import logging
 
-# Supress logging from scapy
+# Suppress logging from scapy
 logging.getLogger("scapy.runtime").setLevel(logging.CRITICAL)
 logging.getLogger("scapy.loading").setLevel(logging.CRITICAL)

src/README.md

@@ -25,7 +25,7 @@ When you write your module, you can decide on which Event to subscribe to, meani
 
 -----------------------
 ### Hunter Types  
-There are three hunter types which you can implement: a `Hunter`, `ActiveHunter` and `Discovery`.  Hunters just probe the state of a cluster, whereas ActiveHunter modules can attempt operations that could change the state of the cluster. Discovery is Hunter for discovery purposes only.
+There are three hunter types which you can implement: a `Hunter`, `ActiveHunter` and `Discovery`. Hunters just probe the state of a cluster, whereas ActiveHunter modules can attempt operations that could change the state of the cluster. Discovery is Hunter for discovery purposes only.
 ##### Hunter  
 Example:  
 ~~~python  

src/core/events/types/common.py

@@ -27,7 +27,7 @@ class Event(object):
     # Event's logical location to be used mainly for reports.
     # If event don't implement it check previous event
     # This is because events are composed (previous -> previous ...)
-    # and not inheritted 
+    # and not inherited
     def location(self):
         location = None
         if self.previous:
@@ -77,7 +77,7 @@ class Vulnerability(object):
         UnauthenticatedAccess: "low"
     })
 
-    # TODO: make vid mandatry once migration is done
+    # TODO: make vid mandatory once migration is done
     def __init__(self, component, name, category=None, vid=None):
         self.vid = vid
         self.component = component
@@ -154,7 +154,7 @@ class ReportDispatched(Event):
     pass
 
 
-""" Core Vulnerabilites """
+""" Core Vulnerabilities """
 class K8sVersionDisclosure(Vulnerability, Event):
     """The kubernetes version could be obtained from the {} endpoint """
     def __init__(self, version, from_endpoint, extra_info=""):

src/modules/hunting/arp.py

@@ -26,7 +26,7 @@ class ArpSpoofHunter(ActiveHunter):
         return ans[ARP].hwsrc if ans else None
 
     def detect_l3_on_host(self, arp_responses):
-        """ returns True for an existance of an L3 network plugin """
+        """ returns True for an existence of an L3 network plugin """
         logging.debug("Attempting to detect L3 network plugin using ARP")
         unique_macs = list(set(response[ARP].hwsrc for _, response in arp_responses))