From 69a31f87e9140f02c0284507c2bdc5d1ddb6aa31 Mon Sep 17 00:00:00 2001 From: blrchen Date: Tue, 3 Mar 2020 07:10:16 +0800 Subject: [PATCH] Fix #127 Insecure Azure Cloud IP detection (#315) * Fix Insecure Azure Cloud IP detection Remove verify=False Co-authored-by: blairch <15134348+blairch@users.noreply.github.com> Co-authored-by: Yehuda Chikvashvili --- kube_hunter/modules/discovery/hosts.py | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/kube_hunter/modules/discovery/hosts.py b/kube_hunter/modules/discovery/hosts.py index e7fc2b1..8583e40 100644 --- a/kube_hunter/modules/discovery/hosts.py +++ b/kube_hunter/modules/discovery/hosts.py @@ -55,12 +55,8 @@ class HostDiscoveryHelpers: def get_cloud(host): try: logging.debug("Checking whether the cluster is deployed on azure's cloud") - # azurespeed.com provide their API via HTTP only; the service can be queried with - # HTTPS, but doesn't show a proper certificate. Since no encryption is worse then - # any encryption, we go with the verify=false option for the time being. At least - # this prevents leaking internal IP addresses to passive eavesdropping. - # TODO: find a more secure service to detect cloud IPs - metadata = requests.get("https://www.azurespeed.com/api/region?ipOrUrl={ip}".format(ip=host), verify=False).text + # Leverage 3rd tool https://github.com/blrchen/AzureSpeed for Azure cloud ip detection + metadata = requests.get(f"https://api.azurespeed.com/api/region?ipOrUrl={host}").text except requests.ConnectionError as e: logging.info("- unable to check cloud: {0}".format(e)) return