* removed arp and dns hunters usage due to it's violations of the scapy GPL2 license
* added installation of arp and dns hunters to Dockerfile
* added explicit new version to plugins in dockerfile installation
* ignore B020 flake8
* added partial and partial-names flag. mechanism for whitelisting hunter subscrption for custom hunts
* changed name from partial to custom
* ran black to format
* flake8 formatting
* added documentation in readme for Custom hunting and made Advanced Usage a higher level topic
* added Collector, StartedInfo and SendFullReport to the core_hunters
* changed old name class-names to raw-hunter-names
* fixed bug in import loop
* Refactored all categories to the new MITRE attack matrix format
* Changed format of vulnerabilities table to display the mitre technique related to the vulnerability
* added service account token flag to use in hunting
* added flag to main parsing config creation
* fixed linting issues
* added documentation on the service-account-token flag
* minor readme change
* removed redundant call for /pods again from /var/log mount hunter, by using multiple subscription
* fixed new linting
* fixed linting with exceptions
* Add a new dependency on Kubernetes package
* Add and store a new flag about automatic nodes discovery from a pod
* Implement the listing of nodes
* Add tests to cover the k8s node listing
* Fix the k8s listing test to ensure the load incluster function is actually called
* Add more help to the k8s node discovery flags, and cross-reference them.
* Add a note on the Kubernetes auto-discovery in the main README file
* Move the kubernetes discovery from conf to modules/discovery
* When running with --pods, run the Kubernetes auto discovery
* Also mention that the auto discovery is always on when using --pod
Co-authored-by: Mikolaj Pawlikowski <mpawlikowsk1@bloomberg.net>
* removed false negative in AzureSpnHunter when /run is disabled
* changed to use direct imported class
* fixed multiple bugs in azure spn hunting, and improved efficency
* fixed bug in cloud identification. TODO: remove the outsourcing for cloud provider
* removed unused config variable
* fixed tests to use already parsed pods as the given previous event has changed
* changed link to point to avd
* changed kb_links to be on base report module. and updated to point to avd. now json output returns the full avd url to the vulnerability
* switched to adding a new avd_reference instead of changed the VID
* added newline to fix linting
Given that the Description tends to go over 100 characters as well, it
seems appropriate to loosen the restriction of the evidence field.
Fixes#111
Co-authored-by: danielsagi <danielsagi2009@gmail.com>
* fixed etcd version hunting typo
* changed self.protocol in other places on etcd hunting. this is a typo, protocol is a property of events, not hunters
Co-authored-by: Daniel Sagi <daniel@example.com>
Co-authored-by: Liz Rice <liz@lizrice.com>
* striping was incorrect due to multiple newlines in certificate returned from ssl.get_server_certificate
* changed ' to " for linting
Co-authored-by: Daniel Sagi <daniel@example.com>
* Introducing active hunters:
- FootholdViaSecureKubeletPort
- MaliciousIntentViaSecureKubeletPort
* Format
Updating code according to expected linting format.
* Format
Updating code according to expected linting format.
* Format
Updating code according to expected linting format.
* Format
Updating code according to expected linting format.
* Testing
Update code according to expected testing standards and implementation.
* Update documentation.
- Added some more mitigations and updated the references list.
* f-string is missing placeholders.
- flake8 is marking this line as an issue as it lacks a placeholder when indicating the use of f-string; corrected.
* Update kubelet.py
- Add network_timeout parameter into requests.post and requests.get execution.
* Update kubelet.py
- Modified name of variable.
* Update kubelet.py and test_kubelet.py
- Remove certificate authority.
* Update kubelet.py and test_kubelet.py.
- Introducing default number of rm attempts.
* Update kubelet.py and test_kubelet.py.
- Introduced number of rmdir and umount attempts.
* Update kubelet.py
- Modified filename to match kube-hunter description.
* Update several files.
- Instated the use of self.event.session for GET and POST requests.
- Testing modified accordingly to complete coverage of changes and introduced methods.
- Requirements changed such that the required version that supports sessions mocking is obtained.
* Update kubelet.py
- Introduced warnings for the following commands in case of failure: rm, rmdir, and umount.
* Update kubelet.py
- Remove "self.__class__.__name___" from self.event.evidence.
* Update kubelet.py
- Remove unnecessary message section.
* Update files.
- Address class change.
- Fix testing failure after removing message section.
* Update kubelet.py
- Provide POD and CONTAINER as part of the warning messages in the log.
Co-authored-by: Abdullah Garcia <abdullah.garcia@jpmorgan.com>
Co-authored-by: Yehuda Chikvashvili <yehudaac1@gmail.com>
Co-authored-by: danielsagi <danielsagi2009@gmail.com>
* fixed f string
* fixed wrong iteration on list when getting random pod
* added '/' suffix to path on kubelet debug handlers tests
* also fixed minor bug in etcd, protocol was refrenced on the hunter and not on the event
* ran black format
* moved protocol to be https
* ran black again
* fixed PR comments
* ran black again, formatting
* Remove plugins
Current usage of plugins is not pluggable and includes logging
stuff.
Move this to conf/logging.
* Removed dynamic imports
* Add tests for hunters registration
danielsagi
Daniel Sagi
JuvenileandGitHub
Tommy McCormickandGitHub
Konstantin WeddigeandGitHub
