k8scout
2 min read
Kubernetes attack path engine for authorized security assessments. Drops into a compromised pod and maps every realistic escalation path to cluster-admin, node escape, secret theft, and cloud IAM takeover.
Builds a weighted permission graph and runs Dijkstra-based pathfinding across 50 detection rules mapped to MITRE ATT&CK techniques.
sh
k8scout # run from inside a compromised pod
What it finds
k8scout builds a weighted permission graph and runs Dijkstra-based pathfinding to discover realistic multi-step attack chains:
• Pod to cluster-admin — through RBAC bindings, workload mutation, or CRB creation
• Container escape to node — via privileged containers, hostPID, hostNetwork, dangerous capabilities, or hostPath mounts
• Lateral movement — exec into other pods, steal their SA tokens, pivot through their permissions
• Secret and credential theft — mounted SA tokens, secrets, configmaps with leaked credentials, orphaned tokens
• Cloud IAM escalation — IRSA (AWS), GKE Workload Identity, Azure Workload Identity, projected token audience abuse
• Impersonation chains — SA-to-SA takeover through impersonation permissions
• Workload mutation — patch a deployment to change its SA, then inherit that SA's permissions
• Webhook injection — mutating webhook control to inject into future workloads
• GitOps operator abuse — ArgoCD, Flux, External Secrets, and Vault operator privilege escalation
• Misconfiguration detection — dangling bindings, wildcard verbs, automounted tokens, plaintext secrets in env vars
Every finding includes MITRE ATT&CK technique IDs, a risk score, and step-by-step attack path with the actual graph nodes involved. 50 detection rules in total.
Quick start
From a compromised pod (primary use case)
bash
# Copy the binary into the pod
kubectl cp k8scout-linux-amd64 <ns>/<pod>:/tmp/k8scout
# Run it
kubectl exec -it <ns>/<pod> -- chmod +x /tmp/k8scout
kubectl exec -it <ns>/<pod> -- /tmp/k8scout --out /tmp/result.json
# Pull the results
kubectl cp <ns>/<pod>:/tmp/result.json ./result.json