diff --git a/docs/_kb/KHV037.md b/docs/_kb/KHV037.md index 170e7d3..6392be2 100644 --- a/docs/_kb/KHV037.md +++ b/docs/_kb/KHV037.md @@ -8,7 +8,7 @@ categories: [Information Disclosure] ## Issue description -The kubelet is is leaking container logs via the `/containerLogs` endpoint. This endpoint is exposed as part of the kubelet's debug handlers. +The kubelet is leaking container logs via the `/containerLogs` endpoint. This endpoint is exposed as part of the kubelet's debug handlers. ## Remediation diff --git a/docs/_kb/KHV038.md b/docs/_kb/KHV038.md index 97f3758..f16d49a 100644 --- a/docs/_kb/KHV038.md +++ b/docs/_kb/KHV038.md @@ -8,7 +8,7 @@ categories: [Information Disclosure] ## Issue description -The kubelet is is leaking information about runnig pods via the `/runningpods` endpoint. This endpoint is exposed as part of the kubelet's debug handlers. +The kubelet is leaking information about running pods via the `/runningpods` endpoint. This endpoint is exposed as part of the kubelet's debug handlers. ## Remediation diff --git a/docs/_kb/KHV039.md b/docs/_kb/KHV039.md index ae796b0..7478afa 100644 --- a/docs/_kb/KHV039.md +++ b/docs/_kb/KHV039.md @@ -8,7 +8,7 @@ categories: [Remote Code Execution] ## Issue description -An attacker could run arbitrary commands on a container via the the kubelet's `/exec` endpoint. This endpoint is exposed as part of the kubelet's debug handlers. +An attacker could run arbitrary commands on a container via the kubelet's `/exec` endpoint. This endpoint is exposed as part of the kubelet's debug handlers. ## Remediation diff --git a/docs/_kb/KHV040.md b/docs/_kb/KHV040.md index aae3a8c..43ebd7d 100644 --- a/docs/_kb/KHV040.md +++ b/docs/_kb/KHV040.md @@ -8,7 +8,7 @@ categories: [Remote Code Execution] ## Issue description -An attacker could run arbitrary commands on a container via the the kubelet's `/run` endpoint. This endpoint is exposed as part of the kubelet's debug handlers. +An attacker could run arbitrary commands on a container via the kubelet's `/run` endpoint. This endpoint is exposed as part of the kubelet's debug handlers. ## Remediation diff --git a/docs/_kb/KHV041.md b/docs/_kb/KHV041.md index 1e02312..2d526e9 100644 --- a/docs/_kb/KHV041.md +++ b/docs/_kb/KHV041.md @@ -8,7 +8,7 @@ categories: [Remote Code Execution] ## Issue description -An attacker could read and write data from a pod via the the kubelet's `/portForward` endpoint. This endpoint is exposed as part of the kubelet's debug handlers. +An attacker could read and write data from a pod via the kubelet's `/portForward` endpoint. This endpoint is exposed as part of the kubelet's debug handlers. ## Remediation diff --git a/docs/_kb/KHV042.md b/docs/_kb/KHV042.md index 5fcc373..1aa0d23 100644 --- a/docs/_kb/KHV042.md +++ b/docs/_kb/KHV042.md @@ -8,7 +8,7 @@ categories: [Remote Code Execution] ## Issue description -An attacker could attach to a running container via a websocket on the the the kubelet's `/attach` endpoint. This endpoint is exposed as part of the kubelet's debug handlers. +An attacker could attach to a running container via a websocket on the kubelet's `/attach` endpoint. This endpoint is exposed as part of the kubelet's debug handlers. ## Remediation diff --git a/docs/_kb/KHV043.md b/docs/_kb/KHV043.md index da2a1f0..26481db 100644 --- a/docs/_kb/KHV043.md +++ b/docs/_kb/KHV043.md @@ -8,7 +8,7 @@ categories: [Information Disclosure] ## Issue description -The kubelet is is leaking it's health information, which may contain sensitive information, via the `/healthz` endpoint. This endpoint is exposed as part of the kubelet's debug handlers. +The kubelet is leaking it's health information, which may contain sensitive information, via the `/healthz` endpoint. This endpoint is exposed as part of the kubelet's debug handlers. ## Remediation diff --git a/docs/_kb/KHV045.md b/docs/_kb/KHV045.md index ecacd3b..9b0cceb 100644 --- a/docs/_kb/KHV045.md +++ b/docs/_kb/KHV045.md @@ -8,7 +8,7 @@ categories: [Information Disclosure] ## Issue description -The kubelet is is leaking system logs via the `/logs` endpoint. This endpoint is exposed as part of the kubelet's debug handlers. +The kubelet is leaking system logs via the `/logs` endpoint. This endpoint is exposed as part of the kubelet's debug handlers. ## Remediation diff --git a/docs/_kb/KHV049.md b/docs/_kb/KHV049.md index 5a297f2..8c0eb90 100644 --- a/docs/_kb/KHV049.md +++ b/docs/_kb/KHV049.md @@ -8,7 +8,7 @@ categories: [Information Disclosure] ## Issue description -An open kubectl proxy was detected. `kubectl proxy` is a convenient tool to connent from a local machine into an application running in Kubernetes or to the Kubernetes API. This is common practice to browse for example the Kubernetes dashboard. Leaving an open proxy can be exploited by an attacker to gain access into your entire cluster. +An open kubectl proxy was detected. `kubectl proxy` is a convenient tool to connect from a local machine into an application running in Kubernetes or to the Kubernetes API. This is common practice to browse for example the Kubernetes dashboard. Leaving an open proxy can be exploited by an attacker to gain access into your entire cluster. ## Remediation diff --git a/plugins/logging_mod.py b/plugins/logging_mod.py index 168e4a9..54ec930 100644 --- a/plugins/logging_mod.py +++ b/plugins/logging_mod.py @@ -1,5 +1,5 @@ import logging -# Supress logging from scapy +# Suppress logging from scapy logging.getLogger("scapy.runtime").setLevel(logging.CRITICAL) logging.getLogger("scapy.loading").setLevel(logging.CRITICAL) diff --git a/src/README.md b/src/README.md index 4f6f640..e8b3ba1 100644 --- a/src/README.md +++ b/src/README.md @@ -25,7 +25,7 @@ When you write your module, you can decide on which Event to subscribe to, meani ----------------------- ### Hunter Types -There are three hunter types which you can implement: a `Hunter`, `ActiveHunter` and `Discovery`. Hunters just probe the state of a cluster, whereas ActiveHunter modules can attempt operations that could change the state of the cluster. Discovery is Hunter for discovery purposes only. +There are three hunter types which you can implement: a `Hunter`, `ActiveHunter` and `Discovery`. Hunters just probe the state of a cluster, whereas ActiveHunter modules can attempt operations that could change the state of the cluster. Discovery is Hunter for discovery purposes only. ##### Hunter Example: ~~~python diff --git a/src/core/events/types/common.py b/src/core/events/types/common.py index ea897aa..190db42 100644 --- a/src/core/events/types/common.py +++ b/src/core/events/types/common.py @@ -27,7 +27,7 @@ class Event(object): # Event's logical location to be used mainly for reports. # If event don't implement it check previous event # This is because events are composed (previous -> previous ...) - # and not inheritted + # and not inherited def location(self): location = None if self.previous: @@ -77,7 +77,7 @@ class Vulnerability(object): UnauthenticatedAccess: "low" }) - # TODO: make vid mandatry once migration is done + # TODO: make vid mandatory once migration is done def __init__(self, component, name, category=None, vid=None): self.vid = vid self.component = component @@ -154,7 +154,7 @@ class ReportDispatched(Event): pass -""" Core Vulnerabilites """ +""" Core Vulnerabilities """ class K8sVersionDisclosure(Vulnerability, Event): """The kubernetes version could be obtained from the {} endpoint """ def __init__(self, version, from_endpoint, extra_info=""): diff --git a/src/modules/hunting/arp.py b/src/modules/hunting/arp.py index ecd0fd4..f8545eb 100644 --- a/src/modules/hunting/arp.py +++ b/src/modules/hunting/arp.py @@ -26,7 +26,7 @@ class ArpSpoofHunter(ActiveHunter): return ans[ARP].hwsrc if ans else None def detect_l3_on_host(self, arp_responses): - """ returns True for an existance of an L3 network plugin """ + """ returns True for an existence of an L3 network plugin """ logging.debug("Attempting to detect L3 network plugin using ARP") unique_macs = list(set(response[ARP].hwsrc for _, response in arp_responses))