Compare commits

..

4 Commits

Author SHA1 Message Date
Daniel Sagi
f4c1e38c6f fixed merge problem in workflow file 2021-10-16 17:41:28 +03:00
Daniel Sagi
eebbc0e735 Merge branch 'main' into remove_cve_scanning 2021-10-16 17:32:48 +03:00
Daniel Sagi
9bff41a938 Made cve hunting optional, defaultly set to not run 2021-10-15 20:54:26 +03:00
Daniel Sagi
da560975b2 Removed registration of the k8s cve hunter. disabled cve hunting 2021-10-15 18:23:00 +03:00
4 changed files with 6 additions and 29 deletions

BIN
MITRE.png

Binary file not shown.

Before

Width:  |  Height:  |  Size: 115 KiB

View File

@@ -18,8 +18,7 @@ kube-hunter hunts for security weaknesses in Kubernetes clusters. The tool was d
**Run kube-hunter**: kube-hunter is available as a container (aquasec/kube-hunter), and we also offer a web site at [kube-hunter.aquasec.com](https://kube-hunter.aquasec.com) where you can register online to receive a token allowing you to see and share the results online. You can also run the Python code yourself as described below.
**Explore vulnerabilities**: The kube-hunter knowledge base includes articles about discoverable vulnerabilities and issues. When kube-hunter reports an issue, it will show its VID (Vulnerability ID) so you can look it up in the KB at https://aquasecurity.github.io/kube-hunter/
_If you're interested in kube-hunter's integration with the Kubernetes ATT&CK Matrix [Continue Reading](#kuberentes-attck-matrix)_
**Explore vulnerabilities**: The kube-hunter knowledge base includes articles about discoverable vulnerabilities and issues. When kube-hunter reports an issue, it will show its VID (Vulnerability ID) so you can look it up in the KB at https://aquasecurity.github.io/kube-hunter/
**Contribute**: We welcome contributions, especially new hunter modules that perform additional tests. If you would like to develop your modules please read [Guidelines For Developing Your First kube-hunter Module](https://github.com/aquasecurity/kube-hunter/blob/main/CONTRIBUTING.md).
@@ -29,7 +28,6 @@ Table of Contents
=================
- [Table of Contents](#table-of-contents)
- [Kuberentes ATT&CK Matrix](#kuberentes-attck-matrix)
- [Hunting](#hunting)
- [Where should I run kube-hunter?](#where-should-i-run-kube-hunter)
- [Scanning options](#scanning-options)
@@ -50,19 +48,7 @@ Table of Contents
- [Pod](#pod)
- [Contribution](#contribution)
- [License](#license)
---
## Kubernetes ATT&CK Matrix
kube-hunter now supports the new format of the Kubernetes ATT&CK matrix.
While kube-hunter's vulnerabilities are a collection of creative techniques designed to mimic an attacker in the cluster (or outside it)
The Mitre's ATT&CK defines a more general standardised categories of techniques to do so.
You can think of kube-hunter vulnerabilities as small steps for an attacker, which follows the track of a more general technique he would aim for.
Most of kube-hunter's hunters and vulnerabilities can closly fall under those techniques, That's why we moved to follow the Matrix standard.
_Some kube-hunter vulnerabities which we could not map to Mitre technique, are prefixed with the `General` keyword_
![kube-hunter](./MITRE.png)
## Hunting
### Where should I run kube-hunter?
@@ -75,7 +61,6 @@ You can run kube-hunter directly on a machine in the cluster, and select the opt
You can also run kube-hunter in a pod within the cluster. This indicates how exposed your cluster would be if one of your application pods is compromised (through a software vulnerability, for example). (_`--pod` flag_)
### Scanning options
First check for these **[pre-requisites](#prerequisites)**.
@@ -156,8 +141,7 @@ Available dispatch methods are:
* KUBEHUNTER_HTTP_DISPATCH_URL (defaults to: https://localhost)
* KUBEHUNTER_HTTP_DISPATCH_METHOD (defaults to: POST)
### Advanced Usage
### Advanced Usage
#### Azure Quick Scanning
When running **as a Pod in an Azure or AWS environment**, kube-hunter will fetch subnets from the Instance Metadata Service. Naturally this makes the discovery process take longer.
To hardlimit subnet scanning to a `/24` CIDR, use the `--quick` option.

View File

@@ -166,9 +166,7 @@ class FromPodHostDiscovery(Discovery):
return True
except requests.exceptions.ConnectionError:
logger.debug("Failed to connect AWS metadata server v1")
except Exception:
logger.debug("Unknown error when trying to connect to AWS metadata v1 API")
return False
return False
def is_aws_pod_v2(self):
config = get_config()
@@ -191,9 +189,7 @@ class FromPodHostDiscovery(Discovery):
return True
except requests.exceptions.ConnectionError:
logger.debug("Failed to connect AWS metadata server v2")
except Exception:
logger.debug("Unknown error when trying to connect to AWS metadata v2 API")
return False
return False
def is_azure_pod(self):
config = get_config()
@@ -210,9 +206,7 @@ class FromPodHostDiscovery(Discovery):
return True
except requests.exceptions.ConnectionError:
logger.debug("Failed to connect Azure metadata server")
except Exception:
logger.debug("Unknown error when trying to connect to Azure metadata server")
return False
return False
# for pod scanning
def gateway_discovery(self):

View File

@@ -16,7 +16,6 @@ class HTTPDispatcher:
dispatch_url,
json=report,
headers={"Content-Type": "application/json"},
verify=False
)
r.raise_for_status()
logger.info(f"Report was dispatched to: {dispatch_url}")