* Inital Commit
Signed-off-by: Vipul Gupta (@vipulgupta2048) <vipulgupta2048@gmail.com>
* Suggestions implemented as suggested
Signed-off-by: Vipul Gupta (@vipulgupta2048) <vipulgupta2048@gmail.com>
* Package with setuptools
Use setuptools to package kube-hunter as redistributable file.
Once packages, it can be pushed to PyPi.
The package version is taken from git tags (using setuptools_scm).
Closes#185
* Ignore __main__.py script in code coverage
The entrypoint script should not be tested but rather be calling
to tested modules.
Ideally, __main__ should only make a call to single function from
another tested module.
* Update requirements files
Use install_requires from setup.cfg file as single source of truth
for dependencies.
Install regular dependencies when installing dev dependencies.
* Symlink kube-hunter.py to entry point
Support the old way to run kube-hunter via the main script by making
a link to the new kube_hunter/__main__.py script.
Co-authored-by: Yehuda Chikvashvili <yehudaac1@gmail.com>
* changed version hunting to be on a a new version disclosure vulnerability
* fixed version publish
* added logging and fixed typo
* changed whole way of comparing versions in cve hunter
* changed K8sVersionDisclosure vulnerability to one core vulnerability, that takes an endpoint. changed all usage
* added tests
* merged kubectl cve hunting with apiserver hunting. and simplified the code of apiserver cve hunting
* fixed tests to new names
* changed name of module to cves.py
* drastically improved the cve vulnerble detection utility function. now works with all types of versioning methods
* added packaging in requirementes.txt
* added another test, and improved logic on cve comparison for more complicated versions
* changed CveHunter to subscribe_once, to prevent duplicates duplicates
* fixed tests for new improvements
* removed unnecessary ternary on doc
* removed unnecessary join split
* improved compare function, made it util
* improved cve checking to use mapping
2. started working on results table.
3. *added convention* from now on, every vulnerability/service event, should have a __doc__ that describes them. notice the new get_name(), component, and explain() attributes that needs to be implemented as well.
2. Added service account token and certificate handling, when running as a pod, to try and access resources that are "secured"
3. Added anonymous auth vulnerability detection
4. Changed requirements.txt for compatibility
The idea is discovering sub paths of resources in the api and sending them for hunting.
Added Dashboard detection from Proxy.
Also improved architecture of discovery/hunting from a "secure" perspective
danielsagiandLiz Rice
Daniel Sagi
nshauli
nshauliandjerbia
Weston Steimel
Cosmin Cojocar
Shir