28 Commits

Author SHA1 Message Date
Kiran Bodipi
bc47f08e88 fix: resolved severity discrepancy between kube-hunter report and docs for khv043 (#551) 2024-03-19 14:30:55 +02:00
Kiran Bodipi
3e1347290b fix: resolved severity discrepancy between kube-hunter report and docs (#550) 2024-03-11 14:22:47 +02:00
Owen Rumney
e1896f3983 docs: lowercase the severities for AVD (#495)
Signed-off-by: Owen Rumney <owen@owenrumney.co.uk>
2022-03-25 09:03:43 +00:00
jerbia
fc7fbbf1fc Added severity to the kube-hunter found issues (#492) 2022-03-22 11:03:05 +02:00
danielsagi
c96312b91e updated gemfile (#464) 2021-06-24 21:15:18 +03:00
Tommy McCormick
5745f4a32b Add discovery for AWS metadata (#447) 2021-04-21 20:57:17 +03:00
miwithro
cdd9f9d432 Update KHV003.md (#439) 2021-03-16 17:17:55 +02:00
Simarpreet Singh
99678f3cac deps: Update github pages dependencies (#431)
Signed-off-by: Simarpreet Singh <simar@linux.com>
2021-01-17 16:03:04 +02:00
Carol Valencia
d208b43532 feat: github actions to publish ecr and docker (#429)
* feat: github actions to publish ecr and docker

* test: github actions to publish ecr and docker

* chore: yaml lint github actions

* chore: yaml lint github actions

* fix: secrets envs for github action

* chore: build and push action for ecr/docker

Co-authored-by: Carol Valencia <krol3@users.noreply.github.com>
2020-12-26 21:31:53 +02:00
Itay Shakury
42250d9f62 move from master branch to main (#427) 2020-12-17 16:16:16 +02:00
danielsagi
a1c2c3ee3e Updated kramdown (#424)
Updated kramdown to a newer patched version, the old version was not patched to CVE-2020-14001
2020-12-17 11:50:02 +00:00
danielsagi
bf7023d01c Added docs for exposed pods (#407)
* added doc _kb for exposed pods

* correlated the new khv to the Exposed pods vulnerability

* fixed linting
2020-11-17 15:22:06 +02:00
Sinith
a476d9383f Update KHV005.md (#403) 2020-11-08 18:42:41 +02:00
Abdullah Garcia
daf53cb484 Two new kubelet active hunters. (#344)
* Introducing active hunters:

- FootholdViaSecureKubeletPort
- MaliciousIntentViaSecureKubeletPort

* Format

Updating code according to expected linting format.

* Format

Updating code according to expected linting format.

* Format

Updating code according to expected linting format.

* Format

Updating code according to expected linting format.

* Testing

Update code according to expected testing standards and implementation.

* Update documentation.

- Added some more mitigations and updated the references list.

* f-string is missing placeholders.

- flake8 is marking this line as an issue as it lacks a placeholder when indicating the use of f-string; corrected.

* Update kubelet.py

- Add network_timeout parameter into requests.post and requests.get execution.

* Update kubelet.py

- Modified name of variable.

* Update kubelet.py and test_kubelet.py

- Remove certificate authority.

* Update kubelet.py and test_kubelet.py.

- Introducing default number of rm attempts.

* Update kubelet.py and test_kubelet.py.

- Introduced number of rmdir and umount attempts.

* Update kubelet.py

- Modified filename to match kube-hunter description.

* Update several files.

- Instated the use of self.event.session for GET and POST requests.
- Testing modified accordingly to complete coverage of changes and introduced methods.
- Requirements changed such that the required version that supports sessions mocking is obtained.

* Update kubelet.py

- Introduced warnings for the following commands in case of failure: rm, rmdir, and umount.

* Update kubelet.py

- Remove "self.__class__.__name___" from self.event.evidence.

* Update kubelet.py

- Remove unnecessary message section.

* Update files.

- Address class change.
- Fix testing failure after removing message section.

* Update kubelet.py

- Provide POD and CONTAINER as part of the warning messages in the log.

Co-authored-by: Abdullah Garcia <abdullah.garcia@jpmorgan.com>
Co-authored-by: Yehuda Chikvashvili <yehudaac1@gmail.com>
Co-authored-by: danielsagi <danielsagi2009@gmail.com>
2020-06-29 09:20:49 +01:00
dependabot[bot]
f33c04bd5b Bump nokogiri from 1.10.4 to 1.10.8 in /docs (#311)
Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.10.4 to 1.10.8.
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.md)
- [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.10.4...v1.10.8)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: Liz Rice <liz@lizrice.com>
2020-03-02 15:23:39 +00:00
Liz Rice
4c82b68f48 Merges #225 (#278)
* Fix typos

* Fix review comments
2019-11-26 21:11:33 +02:00
Greg Jacobs
1c443eb6e4 Fixes for typos and readability in Readme.md and KB (#248) 2019-11-12 14:08:47 +02:00
Anuj Singh
67af48fa9a Create a sitemap (#258) 2019-11-05 21:48:05 +02:00
Itay Shakury
8cc90db8f5 add kb index (#252) 2019-10-30 20:38:16 +02:00
Itay Shakury
04fc39c810 build article titles from metadata (#238)
* rename id to vid to avoid conflict with jekyll's id

* build article title from metadata
2019-10-23 18:22:37 +03:00
Itay Shakury
6b4f13e84a update ruby gems used for the kb website (#236) 2019-10-23 14:03:00 +03:00
suijaa
a8428a9445 typo fix in KHV050.md 2019-10-22 09:03:07 +03:00
Itay Shakury
817070ea30 document api access vulnerabilities (#205)
* document apiinfodisclosure vuln

* fix relative url
2019-10-18 15:50:53 +03:00
Itay Shakury
b4029225dd document DNS spoofing vulnerability (#206)
* document dnsspoof vuln

* fix relative url
2019-10-18 15:40:39 +03:00
Manuel Rüger
1395389c62 kb: typo endoint -> endpoint (#214) 2019-10-18 15:32:34 +03:00
Itay Shakury
8602e2a603 fix navigation url when searching for kb article (#210)
* fix navigation url

* add baseurl
2019-10-18 15:16:20 +03:00
Itay Shakury
f67c437a36 document kubelet vulns (#209) 2019-10-16 18:28:34 +03:00
Itay Shakury
4e68ea4e15 Add Knowledge Base for reported vulnerabilities (#188) 2019-10-13 17:10:47 +03:00