madhuakula/kubernetes-goat

Defence scenarios for the existing scenarios

Open

#17 opened on Sep 1, 2020

View on GitHub
 (1 comment) (1 reaction) (1 assignee)HTML (1,040 forks)batch import
documentationenhancementgood first issuehelp wanted

Repository metrics

Stars
 (5,753 stars)
PR merge metrics
 (PR metrics pending)

Description

Defence scenarios for the below scenarios

  • Sensitive keys in code bases
  • DIND(docker-in-docker) exploitation
  • SSRF in K8S world
  • Container escape to access host system
  • Docker CIS Benchmarks analysis
  • Kubernetes CIS Benchmarks analysis
  • Attacking private registry
  • NodePort exposed services
  • Helm v2 tiller to PwN the cluster
  • Analysing crypto miner container
  • Kubernetes Namespaces bypass
  • Gaining environment information
  • DoS the memory/cpu resources

Contributor guide

Research direction
For each attack scenario listed (e.g., sensitive keys in code bases, DIND exploitation, SSRF in K8S world, container escape, etc.), research and document corresponding defense mechanisms, best practices, and configuration hardening steps to prevent those attacks.
Tech stack
dockerkubernetes
Domain
securitydevops
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
KubernetesDocker
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
70